Back to the CVE list
CVE-2024-9264

Code injection in Grafana

CVSS score

8.8

EPSS probability

%97.1

Risk score

8.5

Published

2 y ago

OverviewPublic Exploits (16)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
ferralon-demo/grafana-cve-2024-9264-duckdb-rce
GitHub

Security case-study: reachability analysis PoE → fix → PoNE on Grafana SQL Expressions DuckDB RCE/LFI (CVE-2024-9264), real code reconstructed at historical commits. Demo only, not for use.

Public PoCSource updated: 21.10.2026 16:58:50
G
barun121/CVE-2024-9264-in-Grafana-11.x
GitHub

Vulnerability Exploitation using tools Penetration Testing, Grafana, Docker, Kali Linux.

Public PoCSource updated: 23.08.2026 11:27:19
G
ozcanpng/CVE-2024-9264
GitHub

CVE-2024-9264 Grafana SQL Expressions DuckDB LFI/RCE PoC

Public PoCSource updated: 22.07.2026 16:28:35
G
yeonchoda/CVE-2024-9264
GitHub

yeonchoda/CVE-2024-9264

Public PoCSource updated: 29.06.2026 12:28:09
G
patrickpichler/grafana-CVE-2024-9264
GitHub

Grafana image with DuckDB binary present vulnerable to exploit CVE-2024-9264

Public PoCSource updated: 21.07.2025 12:21:48
G
rvzsec/CVE-2024-9264
GitHub

Authenticated RCE in Grafana (v11.0) via SQL Expressions - PoC Exploit

Public PoCSource updated: 11.07.2025 21:38:16
G
ruizii/CVE-2024-9264
GitHub

Grafana RCE

Public PoCSource updated: 06.07.2025 08:01:49
G
Royall-Researchers/CVE-2024-9264
GitHub

Royall-Researchers/CVE-2024-9264

Public PoCSource updated: 05.07.2025 14:06:18
G
Exerrdev/CVE-2024-9264-Fixed
GitHub

Exerrdev/CVE-2024-9264-Fixed

Public PoCSource updated: 15.06.2025 00:54:38
G
nollium/CVE-2024-9264
GitHub

Exploit for Grafana arbitrary file-read (CVE-2024-9264) (★2)

Public PoCSource updated: 20.10.2024 02:39:00
G
z3k0sec/CVE-2024-9264-RCE-Exploit
GitHub

Grafana RCE exploit (CVE-2024-9264) (★1)

Public PoCSource updated: 21.10.2024 14:50:53
G
z3k0sec/File-Read-CVE-2024-9264
GitHub

File Read Proof of Concept for CVE-2024-9264 (★0)

Public PoCSource updated: 20.10.2024 11:20:27
G
zgimszhd61/CVE-2024-9264
GitHub

Exploit for Grafana arbitrary file-read (CVE-2024-9264) (★0)

Public PoCSource updated: 20.10.2024 14:34:52
G
Cythonic1/CVE-2024-9264
GitHub

A go implementation for CVE-2024-9264 which effect grafana versions 11.0.x, 11.1.x, and 11.2.x. (★0)

Public PoCSource updated: 01.06.2025 05:08:01
G
rvizx/CVE-2024-9264
GitHub

Authenticated RCE in Grafana (v11.0) via SQL Expressions - PoC Exploit (★0)

Public PoCSource updated: 08.07.2025 00:59:30
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9264.yaml
Nuclei

Nuclei: Grafana Post-Auth DuckDB - SQL Injection To File Read

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2024-9264"