CVE-2025-13294

Affected software: TBEA TLogger web server (firmware version V2.1.0.0B0.0.0.0). Vulnerability: Unauthenticated SQL injection in multiple HTTP endpoints that incorporate attacker-controlled parameters directly into SQLite queries. Impact: attacker can read, modify, or delete data in CCU.db; high c...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

MAL-2026-13716 Malicious code in @sqlite-prime/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...

Malicious code in @sqlite-prime/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...

Malicious code in @sqlite-prime/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01e898636f16aeaf0f90bb35efaccc41186222d35f564d37c65dd1aaf471e03e On require/import, index.js constructs a GitHub Gist API URL https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90, owned by user...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738 SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP prior to 4.4.18 on SQLite-backed installations contains a code injection vulnerability in the navigation endpoint. The endpoint mishandles array-typed user input, bypasses input sanitization, and can break out of a PHP-quoted string context, enabling an authenticated attacker (minimum editor...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

ROOT-OS-ALPINE-322-CVE-2025-70873 CVE-2025-70873 in sqlite - Patched by Root

Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-11822 CVE-2026-11822 in sqlite - Patched by Root

Root has patched CVE-2026-11822 in the sqlite package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-11824 CVE-2026-11824 in sqlite - Patched by Root

Root has patched CVE-2026-11824 in the sqlite package for Root:Alpine:3.22. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-66738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...

EulerOS 2.0 SP11 : sqlite (EulerOS-SA-2026-3158)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...

EulerOS 2.0 SP11 : sqlite (EulerOS-SA-2026-3104)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

Datadog Android app stores operationally sensitive content in plaintext SQLite databases via Room. Two databases analyzed: LocalNotificationDatabase (local_notifications; title, message, recipient, service, tags, on‑call/incident deeplinks) and SearchRecentDatabase (search_recents; stores every i...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

EUVD-2026-54275

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...