DEBIAN-CVE-2022-31631

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities...

CVE-2022-31631 PDO::quote() may return unquoted string

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities...

SUSE CVE-2025-24786

WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the applicati...

PT-2025-15991

Name of the Vulnerable Software and Affected Versions: sqlite version 3.49.0 Description: The issue allows an attacker to cause a denial of service via the SQLITE DBCONFIG LOOKASIDE component. Recommendations: For sqlite version 3.49.0, consider disabling the SQLITE DBCONFIG LOOKASIDE component a...

CVE-2025-24786 Path traversal opening Sqlite3 database in WhoDB

WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the applicati...

WhoDB 安全漏洞

WhoDB is a data browser from clidey open source. A security vulnerability exists in WhoDB 0.45.0 and earlier versions, which stems from the lack of protection against path traversal, allowing an unauthenticated attacker to open any Sqlite3 database on the running host...

PT-2025-5856

Name of the Vulnerable Software and Affected Versions WhoDB versions prior to 0.45.0 Description The issue allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on, due to the lack of path traversal prevention. The database fil...

CVE-2022-24854

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2024-47881

OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load local or remote extension DLLs and so run...

BIT-SUPERSET-2023-39265 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

CVE-2024-51748

Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting applicationlanguage in the...

CVE-2024-51747

Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its path entry in the projecthasfiles SQLite db...

MAL-2025-1234 Malicious code in tree-sitter-sqlite (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6171aef6bf33d3a77ea0523c0609d12e396a579ce197757f9ac020689a6c2363 Any computer that has this package installed or running should be considered...

Malicious code in tree-sitter-sqlite (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6171aef6bf33d3a77ea0523c0609d12e396a579ce197757f9ac020689a6c2363 Any computer that has this package installed or running should be considered...

[SECURITY] Fedora 41 Update: buku-4.9-1.fc41

Buku is a powerful bookmark manager written in Python3 and SQLite3. Buku fetches the title of a bookmarked web page and stores it along with any additional comments and tags. You can use your favourite editor to compose and update bookmarks. With multiple search options, including regex and a dee...

Elspec G5 Digital Fault Recorder Improper Handling of Insufficient Permissions or Privileges (CVE-2024-22077)

An issue was discovered in Elspec G5 digital fault recorder. The SQLite database file has weak permissions. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if descriptio...

CVE-2022-46908 affecting package sqlite 3.34.1-2

CVE-2022-46908 affecting package sqlite 3.34.1-2. This CVE either no longer is or was never applicable...

SQLite report about CVE-2025-3277CVE-2025-29087

A bug in the concatws SQL function can cause a write past the end of an array obtained from malloc. If an attacker can control the first argument to concatws, so that the separator string is large - more than 2MB - then an integer overflow in the calculation of the size of the result buffer might...

SQLite report about CVE-2025-7458

An attacker who can inject arbitrary SQL statements into an application might be able to cause an integer overflow resulting in a read off the end of an array. Fixed on 2023-03-16...

SQLite report about CVE-2025-70873

When using the zipfile extension not a part of standard SQLite but usually included in builds of the CLI, a malformed ZIP file input can result in an out-of-bounds read. Reported by forum post 2025-12-06T16:46:32Z and fixed in trunk by check-in 2025-12-06T23:58:09.413Z...