1dayexploit

Cyber security research hub.

We take vulnerabilities apart, find new ones, and build the tooling that proves both.

[1dayexploit @1dayexploit]

🔥 Metabase: Unauthenticated SQL Injection to Admin Takeover Analysis

🔴 CVE-2026-72898 & CVE-2026-72899 🔴
🗓️ Publish Date: 10 Aug 2026

ÂLIM rebuilt both, wrote a proof of concept for each, and confirmed it fires on the vulnerable build and stays silent on the patched one.

Metabase has patched CVE-2026-72898 and CVE-2026-72899. Both are unauthenticated SQL injection. Neither one needs a password, a token, or a click.

🔎 Full Technical Analysis and PoCs:

CVE-2026-72898: https://t.co/VwJDS7Ulab

CVE-2026-72899: https://t.co/2fOz7msQ0V

Fixed in 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5.

--

#Metabase #1dayexploit #ALIM #SQLInjection #RedTeam #OffSec #VulnerabilityResearch #CyberSecurity #InfoSec #AppSec #Exploit

[1dayexploit @1dayexploit]

@Jich_ Thanks, glad it is useful.

Both already exist. RSS: https://t.co/fqfZA96FeN
Every write-up, with proper guid and pubDate, and it is auto discoverable from the homepage, so a bot can just point at the domain.

Submissions: https://t.co/EptoK1SF5U
Pick any CVE and request it. No account, no quota. We publish whatever comes back, including the runs where we could not reproduce the claim.

Appreciate you taking the time to look through it.

[1dayexploit @1dayexploit]

🚀 1dayexploit is officially live!! 🎉🎉

Today, we’re excited to open 1dayexploit to the security community.

🌐 https://t.co/pOrVDJIyeK
🦉 Explore ÂLIM: https://t.co/L0yo5w50MN

Built for offensive security researchers, 1dayexploit is a platform focused on high-quality technical research, in-depth CVE analysis, root cause investigations, exploit development, PoCs, and practical security insights.

As part of the platform, we’re also introducing ÂLIM. Our AI-powered research assistant that helps transform CVEs into technical evidence. Rather than simply summarizing vulnerabilities, ÂLIM analyzes root causes, explains the affected code, assists with exploit development, and helps researchers understand the real-world impact of security issues.

This is just the beginning. We’re continuously building new research capabilities, AI-driven workflows, and features to help security researchers move faster and dive deeper into vulnerability research.

We’d love to hear your feedback and suggestions.
✉️ [email protected]

#ALIM #1dayexploit #CyberSecurity #OffensiveSecurity #AppSec #RedTeam #BugBounty #CVE #ExploitDevelopment #VulnerabilityResearch #AI #LLM

[1dayexploit @1dayexploit]

🚨 WORDPRESS - CVSS 9.8 - CRITICAL Unauth RCE 🚨

CVE-2026-63030 | ALIM-2026-63030 | aka wp2shell
⚡ PoC + working exploit code now live

Unauthenticated RCE on WordPress 6.9.x/7.0.x via REST batch route confusion + SQLi chain.
Found & exploited fully autonomously by ALIM. Webshell drop + command execution confirmed.

Full write-up, patch diff & PoC 👇

🔗 https://t.co/Kafitl6y6n

#exploit #PoC #WordPress #wp2shell #RCE #CVE #CyberSecurity #RedTeam #1dayexploit #ALIM

[1dayexploit @1dayexploit]

https://t.co/Tzob98Dpe5