PYSEC-2026-1110 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

Summary The client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. Details It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary...

EUVD-2025-124541

Malicious code in neptune-shelljs-mysql-local npm...

MAL-2025-145379 Malicious code in neptune-shelljs-mysql-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d160095b072fe5c1f1c68de0e9a0cb000ff18e829d29172c19bac0398cc3cdd5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2017-3992

Malware in sbrugna...

CVE-2025-9273

CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

SUSE CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...

UBUNTU-CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...

PT-2017-12545

Name of the Vulnerable Software and Affected Versions MantisBT versions through 2.5.2 Description The issue arises when the 'admin' directory is not removed after installation, and the MySQL client has the local infile setting enabled. This allows an attacker to exploit MySQL's "connect file read...

MySQL 5.5.45 (64bit) - local credential information disclosure

No description provided by source. mport time from winappdbg import Debug, Process def b2hstr: return ''.join"%02X " % ordx for x in str.strip def h2bstr: bytes = str = ''.joinstr.split" " for i in range0, lenstr, 2: bytes.appendchrintstri:i+2, 16 return ''.joinbytes usr = '' pwd = '' count = 0...

CVE-2016-0650

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication...