CVE-2024-24213

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.

• CWE-89
• CWE-89

• https://app.flows.sh:8443/project/default%2CBroken Link
• https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213Third Party Advisory
• https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer.Broken Link
• https://reference1.example.com/project/default/logs/explorer%2CBroken Link
• https://supabase.com/docs/guides/database/overview#the-sql-editorVendor Advisory
• https://app.flows.sh:8443/project/default%2CBroken Link
• https://github.com/940198871/Vulnerability-details/blob/main/CVE-2024-24213Third Party Advisory
• https://postfixadmin.ballardini.com.ar:8443/project/default/logs/explorer.Broken Link
• https://reference1.example.com/project/default/logs/explorer%2CBroken Link
• https://supabase.com/docs/guides/database/overview#the-sql-editorVendor Advisory

Published

Feb 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24195robdns commit d76d2e6 was discovered to contain a misaligned…7.5
• CVE-2024-24198smartdns commit 54b4dc was discovered to contain a misaligne…7.5
• CVE-2024-24199smartdns commit 54b4dc was discovered to contain a misaligne…7.5
• CVE-2024-2420LenelS2 NetBox access control and event monitoring system wa…9.8
• CVE-2024-24202An arbitrary file upload vulnerability in /upgrade/control.p…9.8
• CVE-2024-2421LenelS2 NetBox access control and event monitoring system wa…9.8
• CVE-2024-24215An issue in the component /cgi-bin/GetJsonValue.cgi of Celli…5.3
• CVE-2024-24216Zentao v18.0 to v18.10 was discovered to contain a remote co…9.8
• CVE-2024-2422LenelS2 NetBox access control and event monitoring system wa…8.8
• CVE-2024-2423The UsersWP – Front-end login form, User Registration, User …6.4
• CVE-2024-24230Komm.One CMS 10.4.2.14 has a Server-Side Template Injection …7.5
• CVE-2024-2424 An input validation vulnerability exists in the Rockwell Au…7.5