26 matches found
Nuclei: Local File Read via MySQL Client Sandbox Bypass
A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...
GHSA-XHMX-W2J4-RW3Q Nuclei: Local File Read via MySQL Client Sandbox Bypass
A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...
CVE-2026-76803
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...
CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...
CVE-2026-76803
The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its nuclei/mysql JavaScript library. The library fails to enforce local-file sandbox restrictions when a javascript: template provides the allowAllFiles MySQL DSN option. This allows an attacker controlling a MyS...
CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...
CVE-2026-76803: Improper Access Control
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...
PT-2026-96834
Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The nuclei/mysql JavaScript library fails to enforce the local-file sandbox when a JavaScript template uses the allowAllFiles MySQL DSN option. This allows an untrusted javascript: template...
CVE-2026-40899
DataEase
CVE-2026-32949: Server-Side Request Forgery (SSRF)
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery SSRF vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the...
EUVD-2022-3732
Malicious code in bioql PyPI...
CVE-2025-24787: Improper Neutralization of Special Elements in Data Query Logic
WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...
Exploit for Command Injection in Apache Airflow
Apache Airflow SQL injection PoC CVE-2023-22884 PoC for C...
MySQL for Node.js Unsafe Options
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
GHSA-F982-MXWC-3MRX MySQL for Node.js Unsafe Options
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
CVE-2018-14669
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...
PT-2019-9040 · Clickhouse · Clickhouse Mysql Client
Name of the Vulnerable Software and Affected Versions: ClickHouse MySQL client versions prior to 1.1.54390 Description: The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files fr...
CVE-2018-14669: Exposure of Sensitive Information to an Unauthorized Actor
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...
