Exploitation Summary
EIP tracks 4 public exploits for CVE-2025-48757. PoCs published by Farenhytee, Omji-krypto, git-akki.
AI-analyzed exploit summary This repository is a technical writeup and documentation for a database security auditing tool called 'Database Sentinel'. It provides detailed analysis of security vulnerabilities, anti-patterns, and remediation steps for databases like Supabase, MongoDB, and others. The content includes structured documentation, detection methods, and fix templates, but does not contain functional exploit code.
Description
An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.
Exploits (4)
This repository is a technical writeup and documentation for a database security auditing tool called 'Database Sentinel'. It provides detailed analysis of security vulnerabilities, anti-patterns, and remediation steps for databases like Supabase, MongoDB, and others. The content includes structured documentation, detection methods, and fix templates, but does not contain functional exploit code.
This repository contains a security scanning tool called 'db-fortress' designed to detect misconfigurations and vulnerabilities in Supabase Edge Functions and Postgres databases. It includes features like JWT probing, source code scanning for hardcoded credentials, and supply chain drift detection.
This repository provides a comprehensive security audit framework for AI-generated applications, focusing on common vulnerabilities like exposed secrets, BOLA, and misconfigurations. It includes detailed checks, incident references, and remediation templates but does not contain functional exploit code.
This repository provides a comprehensive security auditing tool for Supabase projects, detailing vulnerability patterns, detection methods, and remediation steps. It includes technical analysis of CVE-2025-48757 and other security risks, but does not contain functional exploit code.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N