Sploitus

12 exploited vulnerabilities in H2

Vulnerabilities with publicly known exploits

Vendors
H2, Metabase, Sqlite, Amazon, Dataease, Unknown
With known exploits
12
Affected Metabase versions
< 0.58.15, 0.59.12, 0.60.6.3, 0.61.1.4, 1.58.15, 1.59.12, 1.60.6.3, 1.61.1.4
Affected Cognitect Datomic versions
< 0.9.5697
Affected h2database h2 versions
= 1.4.197
Affected Hyper h2 versions
= 0.2.4
Affected Hyper versions
= 0.13.7
Affected Apache Skywalking versions
≤ 6.6.0, 7.0.0
Affected Thoughtworks Gocd versions
< 23.1.0

Vulnerabilities with exploits

Highest CVSS first — 4 of these already have exploit code on Sploitus

CVE-2023-37470
CVSS 10.0 CRITICAL 2023-08-04FIX AVAILABLE
CVE-2026-59827 2 exploits
CVSS 9.9 CRITICAL 2026-05-16FIX AVAILABLE
Exploit for Deserialization of Untrusted Data in MetabaseExploit for Deserialization of Untrusted Data in Metabase
CVE-2025-58748
CVSS 9.8 CRITICAL 2025-09-15FIX AVAILABLE
CVE-2025-57804
CVSS 9.8 CRITICAL 2025-08-23FIX AVAILABLE
CVE-2021-23463
CVSS 9.1 CRITICAL 2021-12-10
CVE-2025-62420
CVSS 8.8 HIGH 2025-10-17FIX AVAILABLE
CVE-2018-10054 2 exploits
CVSS 8.8 HIGH 2018-04-11FIX AVAILABLE
h2database-rce-pocH2 Web Interface Create Alias RCE
CVE-2022-31394
CVSS 7.8 HIGH 2023-02-21FIX AVAILABLE
CVE-2023-26964
CVSS 7.8 HIGH 2023-04-11FIX AVAILABLE
CVE-2020-9483 1 exploit
CVSS 7.5 HIGH 2020-06-30FIX AVAILABLE
Exploit for SQL Injection in Apache Skywalking
CVE-2018-14335 4 exploits
CVSS 6.5 MEDIUM 2018-07-24FIX AVAILABLE
H2 Database 1.4.197 - Information Disclosure ExploitH2 Database 1.4.197 - Information Disclosure
CVE-2023-28630
CVSS 4.2 MEDIUM 2023-03-27FIX AVAILABLE