CVE-2023-31717

CVE-2023-31717 Es posible realizar una inyección SQL en el parámetro id de HTTP POST pasado en el cuerpo como json, pudiendo extraer información confidencial de la base de datos SQLite. Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AND...

Teamsniper

Teamsniper Teamsniper is a tool for fetching keywords in a Microsoft Teams such as passwords, emails, database, etc.. Usage Help Options usage: Teamsniper.py -h -d DATABASE -a AUTHTOKEN -s SEARCH Teamsniper is a tool for fetching the given keywords in Microsoft Teams. options: -h, --help show thi...

EUVD-2026-86482

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85082

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85082: Improper Neutralization of Special Elements used in an OS Command

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

EUVD-2026-86162

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

PT-2026-98316

Name of the Vulnerable Software and Affected Versions Root Browser Classic version 3.3.0 Description Root Browser Classic passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command. This lack of separation can allow for comma...

CVE-2026-61570

The MPXJ open-source library (versions 5.5.5 through 16.4.1 ) is vulnerable to an XML External Entity (XXE) injection. The flaw exists in the MerlinReader component when parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database. Because the DocumentBuilder uses default settin...

PT-2026-97035

Name of the Vulnerable Software and Affected Versions MPXJ versions 5.5.5 through 16.4.0 Description When parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, the software creates a DocumentBuilder with default settings that leave doctype declarations and external...

EUVD-2026-83460

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875: Insecure Storage of Sensitive Information

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875

Hide Photos – Secure vault (version 4.1.0 ) stores vault media and wallet records in shared external storage , where the data is not bound to the application's calculator-style passcode authentication boundary. A local actor with access to shared external storage—such as through an authorized non...

CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

PT-2026-95718

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The application uses a calculator-style vault passcode to protect access, but the stored data is not bound to this authentication boundary. A local actor with...

Astra Linux – Vulnerability in SQLite3

A flaw was discovered in SQLite’s SELECT query functionality src/select.c. This flaw allows an attacker who is capable of executing SQL queries locally on the SQLite database to cause a denial of service or potentially lead to code execution by triggering a use-after-free. The most significant...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.49.0 before 3.49.1, certain argument values passed to sqlite3dbconfig in the C-language API can cause a denial of service application crash. A sznBig multiplication is not cast to a 64-bit integer, which can lead to incorrect memory allocations...

GHSA-WPMR-8H3Q-FWJ7 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...