CVE-2022-0944

HighPublished

Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

Published: Mar 15, 2022
Updated: Aug 2, 2024
Assigning CNA: @huntrdev
Evidence observed: Aug 8, 2026

Primary CVSS

7.2/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

8.7%

Low · next 30 days

Percentile: 95.1%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

Sources

SQLPad-6.10.0-Exploit-CVE-2022-0944Exploit
Refurbish
sqlpad-rce-exploit-CVE-2022-0944Exploit
Python exploit for CVE-2022-0944 enabling blind remote code execution in SQLPad through the /api/test-connection endpoint with netcat callback.
CVE-2022-0944Exploit
SQLPad - Template injection (POC exploit for SQLPad RCE [CVE-2022-0944])
SQLPad-RCE-Exploit-CVE-2022-0944Exploit
CVE-2022-0944 Remote Code Execution Exploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.