Free member? Read here —

If you’ve worked with backend development, you’ve probably written SQL queries like:

PostgreSQL is one of the most widely used open source database platforms in modern technology environments. It supports enterprise…

Task 1 — Introduction

TL;DR MongoDB fixed 24 MongoDB Server vulnerabilities in recent releases. One critical flaw can leave authorization disabled at startup. Most others cause denial of service, and no in-the-wild exp…

About the Lab

SQL injection has been near the top of every “most dangerous web vulnerabilities” list for over two decades. It is old, well understood…

TL;DR The Apache Software Foundation addressed two security flaws in its real-time analytics database. These Apache Doris vulnerabilities allow remote attackers to access cluster metadata or execu…

Continuing my web security series, I tackled PortSwigger’s SQL injection attack, querying the database type and version on Oracle.

TL;DR MongoDB issued security advisories detailing seven MongoDB driver vulnerabilities across its database ecosystem. These flaws allow remote attackers to redirect database connections, trigger …

TL;DR PostgreSQL developers patched a critical integer wraparound flaw in the fuzzystrmatch module. This PostgreSQL RCE vulnerability permits low-privileged database users to execute arbitrary com…

A teen hacker found an authentication flaw in Microsoft’s Titan analytics service, where metadata indicated an estimated 17.3 trillion stored rows.

TL;DR MariaDB disclosed nine vulnerabilities on October 9, 2026, covering its database server and the Connector/C client library. Five of the MariaDB vulnerabilities rate high, with CVSS scores up…

TL;DR Progress patched 31 MarkLogic Server vulnerabilities in its October 2026 security bulletin. Three flaws score 9.9 on CVSS and can give low-privileged users elevated code execution or full ad…

An misconfigured Vibetech database exposed 13.7 million records from previous breaches, including AT&T, Casio and FBI data, passwords and bank details.

TL;DR On October 16-17, 2026, Defused’s honeypots caught attackers exploiting CVE-2026-25243, a Redis RESTORE vulnerability rated CVSS 7.7. The memory bug can lead to remote code execution f…

In my previous write-up I solved this lab the “normal” way, using Burp Suite Repeater. 👉 Read here

TL;DR MariaDB disclosed seven more security flaws on October 16, 2026, including three rated CVSS 9.9. These MariaDB critical vulnerabilities let a low-privileged user corrupt memory or reach file…

TL;DR On October 20, 2026, Apache disclosed six Apache CouchDB vulnerabilities, led by a CVSS 9.3 command execution flaw. CouchDB 3.5.3 fixes all of them. Apache also published four flaws in the r…