How a classic SQL injection flaw led to SYSTEM-level compromise through Oracles Java engine

TL;DR Metabase disclosed a critical SQL injection zero-day rated CVSS 10. An unauthenticated remote attacker can gain full administrator access to an instance. Metabase confirms active exploitatio…

In normal case,

What’s up everyone! Nitin here 👋

Introduction

If you’re learning web application security, there’s a good chance you’ve heard about SQL injection a hundred times before you actually do…

1. Overview of CVE-2026–65761

This is the walkthrough of portswigger lab: Blind SQL injection with time delays and information retrieval.

SQL Injection Is Still the #1 Threat in 2026

Objective