Database — PoC Archivehttps://poc.intelseclab.com/tags/database/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000MariaDB — Low-Privilege Remote Code Execution via ST_Area OOB Read + SYS_REFCURSOR Use-After-Freehttps://poc.intelseclab.com/pocs/binary/2026-08-09_mariadb-low-priv-rce-st-area-cursor-uaf/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_mariadb-low-priv-rce-st-area-cursor-uaf/Critical severity (CVSS 8.8) — binary · MDEV-40328 (ST_Area OOB read); cursor-array UAF has no assigned CVE yet. Status: Unpatched. Affects: MariaDB Server, ST_Area() geometry function and SYS_REFCURSOR cursor-array management. Tags: mariadb, database, rce, low-privilege, heap, oob-read, use-after-free, aslr-bypass, pie-bypass, coop, vtable, cursor, st-area, multipolygon, CWE-125, CWE-416, docker, v12-security.binaryCriticalmariadbdatabasercelow-privilegeheapoob-readuse-after-freeaslr-bypasspie-bypasscoopvtablecursorst-areamultipolygonCWE-125CWE-416dockerv12-securityPterodactyl Panel Unauthenticated Path Traversal via locale.json Leaking Database Credentials (CVE-2025-49132)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49132-pterodactyl-locale-path-traversal/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-49132-pterodactyl-locale-path-traversal/Critical severity (CVSS 10) — web · CVE-2025-49132. Status: Weaponized. Affects: Pterodactyl Panel (game server management panel). Tags: pterodactyl, path-traversal, unauthenticated, information-disclosure, credential-leak, database, php, config-exposure, cwe-22.webCriticalpterodactylpath-traversalunauthenticatedinformation-disclosurecredential-leakdatabasephpconfig-exposurecwe-22MikroORM Custom Type Raw SQL Injection (CVE-2026-34220)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34220-mikroorm-sql-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34220-mikroorm-sql-injection/High severity — web · CVE-2026-34220. Status: PoC. Affects: MikroORM (Node.js/TypeScript ORM). Tags: sql-injection, mikroorm, nodejs, typescript, orm, docker, database.webHighsql-injectionmikroormnodejstypescriptormdockerdatabaseMariaDB server_audit Plugin Logging Bypass via Inline Comments (CVE-2026-3494)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-3494-mariadb-audit-log-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-3494-mariadb-audit-log-bypass/Medium severity — network · CVE-2026-3494. Status: PoC. Affects: MariaDB Server server_audit audit-logging plugin. Tags: mariadb, audit-log-bypass, server_audit, logging-evasion, database, regression, sql.networkMediummariadbaudit-log-bypassserver_auditlogging-evasiondatabaseregressionsqlPostgreSQL Referential-Integrity Owner-Switched Implicit Cast RCEhttps://poc.intelseclab.com/pocs/network/2026-07-04_postgres-ri-owner-switched-cast-rce/Sat, 04 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-04_postgres-ri-owner-switched-cast-rce/High severity — network · None assigned as of 2026-07-04. Status: PoC. Affects: PostgreSQL (server). Tags: postgresql, privilege-escalation, referential-integrity, implicit-cast, command-execution, database, uncoordinated-disclosure.networkHighpostgresqlprivilege-escalationreferential-integrityimplicit-castcommand-executiondatabaseuncoordinated-disclosure