Adminer-CVE-2021-43008

Adminer CVE-2021-43008 PoC Proof-of-concept exploit for CVE-2021-43008 affecting Adminer. This vulnerability allows a malicious MySQL server to request arbitrary local files from the client machine when LOAD DATA LOCAL INFILE is enabled. The repository contains tools to reproduce the attack...

MysqlHoneypot

Introduction MysqlHoneypot is a Mysql honeypot project, which mainly uses load data local infile to obtain the user name of the attacker's host Windows platform, and further obtains the WeChat ID according to the user name, and then obtains the user's mobile phone number, login address and other...

GHSA-XHMX-W2J4-RW3Q Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

CVE-2026-76803

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803

The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its nuclei/mysql JavaScript library. The library fails to enforce local-file sandbox restrictions when a javascript: template provides the allowAllFiles MySQL DSN option. This allows an attacker controlling a MyS...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803: Improper Access Control

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

PT-2026-96834

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The nuclei/mysql JavaScript library fails to enforce the local-file sandbox when a JavaScript template uses the allowAllFiles MySQL DSN option. This allows an untrusted javascript: template...

Linux Distros Unpatched Vulnerability : CVE-2026-61700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9,...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass through the ClientMessage server-initiated LOCAL INFILE handling in src/main/java/org/mariadb/jdbc/message/ClientMessage.java. An attacker can make the client send a local file by replying to a LOAD DATA LOCAL INFI...

MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Summary MariaDB Connector/J does not enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE requests protocol packet type 0xfb. However, exploitation is constrained: the server can only request the exact filename the client already included in its LOAD DATA LOCAL INFILE quer...

GHSA-WXMM-Q36W-R9XJ MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Summary MariaDB Connector/J does not enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE requests protocol packet type 0xfb. However, exploitation is constrained: the server can only request the exact filename the client already included in its LOAD DATA LOCAL INFILE quer...

CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

DEBIAN-CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

EUVD-2026-81903

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700

MariaDB Connector/J (Java driver for MariaDB/MySQL) has a flaw in ClientMessage.readPacket : it processes a server-initiated LOCAL INFILE protocol packet (0xfb) without enforcing the allowLocalInfile=false setting. When an application sends a LOAD DATA LOCAL INFILE query, a rogue or man-in-the-mi...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...