Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

GHSA-XHMX-W2J4-RW3Q Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

CVE-2026-76803

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803

The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its nuclei/mysql JavaScript library. The library fails to enforce local-file sandbox restrictions when a javascript: template provides the allowAllFiles MySQL DSN option. This allows an attacker controlling a MyS...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

PT-2026-96834

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The nuclei/mysql JavaScript library fails to enforce the local-file sandbox when a JavaScript template uses the allowAllFiles MySQL DSN option. This allows an untrusted javascript: template...

CVE-2026-76803: Improper Access Control

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-40899

DataEase

CVE-2026-32949: Server-Side Request Forgery (SSRF)

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery SSRF vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the...

EUVD-2020-6193

Malware in sbrugna...

EUVD-2022-3732

Malicious code in bioql PyPI...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

CVE-2025-24787: Improper Neutralization of Special Elements in Data Query Logic

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...

Exploit for Command Injection in Apache Airflow

Apache Airflow SQL injection PoC CVE-2023-22884 PoC for C...

PT-2022-5001

Name of the Vulnerable Software and Affected Versions ruby-mysql versions prior to 2.10.0 Description The issue allows a malicious MySQL server to request local file content from a client using ruby-mysql without explicit authorization from the user. A malicious actor can read arbitrary files fro...

GHSA-F982-MXWC-3MRX MySQL for Node.js Unsafe Options

An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...

MySQL for Node.js Unsafe Options

An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

Code injection

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...