FreeBSD : py-WsgiDAV -- Multiple vulnerabilities (0f5aaca7-c4d5-11f1-96b4-74563cf85f9d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0f5aaca7-c4d5-11f1-96b4-74563cf85f9d advisory. [email protected] reports: WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDA...

PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

WsgiDAV MySQL provider has a blind SQL injection

SummaryThe sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

inginious (0.6.0) potentially affected by CVE-2026-55509 via wsgidav (2.2.4)

wsgidav PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious 0.6.0 Source cves: CVE-2026-55509 Source advisory: OSV:PYSEC-2026-3945...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-55509 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-55509 Source advisory: OSV:PYSEC-2026-3945...

SQL Injection

WsgiDAV is vulnerable to SQL Injection. The vulnerability is due to the MySQLBrowserProvider directly concatenating a record key from the request URL into SQL WHERE clauses, which allows an attacker with access to a share configured with this non-default provider to inject malicious SQL through a...

CVE-2026-55509

creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:31+00:00| published-proof-of-concept| https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

manabi (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-55509 via wsgidav (3.1.1)

wsgidav PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - manabi =0.1.0, =0.4.0 Source cves: CVE-2026-55509 Source advisory: OSV:GHSA-P6GW-4FRG-J7JW...

WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

GHSA-P6GW-4FRG-J7JW WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-55509 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-55509 Source advisory: OSV:GHSA-P6GW-4FRG-J7JW...

SQL Injection

Overview WsgiDAV is a Generic and extendable WebDAV server based on WSGI Affected versions of this package are vulnerable to SQL Injection via the MySQLBrowserProvider process. An attacker can extract arbitrary data from the backing database by injecting crafted SQL through the URL, exploiting th...

EUVD-2026-67857

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

inginious (>=0.6.0, <=0.9.2), manabi (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-55509 via wsgidav (>=2.2.4, <=4.3.3)

wsgidav PYPI version =2.2.4, =0.6.0, =0.1.0, =0.4.0 Source cves: CVE-2026-55509 Source advisory: MEND:CVE-2026-55509...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55509

WsgiDAV , a Python-based WebDAV server, has a blind SQL injection vulnerability in its sample MySQLBrowserProvider (wsgidav/samples/mysql_dav_provider.py). The affected methods (_exists_record_by_primary_key, _get_field_by_primary_key, _get_record_by_primary_key) concatenate a record key parsed f...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...