DEBIAN-CVE-2025-44203

In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages...

UBUNTU-CVE-2019-8425

includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...

CVE-2006-5702: Exposure of Sensitive Information to an Unauthorized Actor

Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information MySQL username and password via an empty sortmode parameter in 1 tiki-listpages.php, 2 tiki-lastchanges.php, 3 messu-archive.php, 4 messu-mailbox.php, 5 messu-sent.php, 6 tiki-directoryaddsite.php, 7 tiki-directoryranking.php,...