Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Summary Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules e.g., csvreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system e.g.,...

GHSA-HWRQ-8WXH-Q4XV Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Summary Anyquery's server mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules e.g., jsonreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints or...

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Summary Anyquery's server mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules e.g., jsonreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints or...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the ATTACH DATABASE process. An attacker can overwrite arbitrary files on the filesystem by sending crafted SQL commands to the server, potentially leading to execution of malicious code or disruption of...

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Summary Anyquery's server mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the ATTACH DATABASE command to write arbitrary SQLite databases to any path on the victim's filesystem where the...

GHSA-XRCF-6JH3-GGVX Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Summary Anyquery's server mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the ATTACH DATABASE command to write arbitrary SQLite databases to any path on the victim's filesystem where the...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the ATTACH DATABASE process. An attacker can overwrite arbitrary files on the filesystem by sending crafted SQL commands to the server, potentially leading to execution of malicious code or disruption of...

PT-2026-60080

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When running in server mode, the software fails to restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the...

PT-2026-60103

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When operated in server mode, the software lacks input sanitization and access control for its built-in SQLite virtual table modules, such as csv reader and log reader. Unauthenticated...

PYSEC-2026-2864 pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract t...

PYSEC-2026-1770 pgAdmin has Incorrect Default Permissions

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously...

PYSEC-2026-729 pgAdmin 4 Path Traversal vulnerability

When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques...

PYSEC-2026-452 pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's...

PYSEC-2026-454 pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode

pgAdmin versions up to 9.9 are affected by a Remote Code Execution RCE vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical...

GHSA-5VWR-QCHF-Q4PF @cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths

Summary A command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3. When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were...

GO-2026-5649 Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` in github.com/hahwul/dalfox

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via found-action in github.com/hahwul/dalfox...

GO-2026-5257 Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option in github.com/hahwul/dalfox

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via output Option in github.com/hahwul/dalfox...

GO-2026-5070 Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in github.com/hahwul/dalfox

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in github.com/hahwul/dalfox...

CVE-2026-12046

A flaw was found in pgAdmin 4. Critical functions within the SQL Editor blueprint lacked proper authentication, allowing a remote attacker to bypass security controls. When combined with specific preconditions, such as knowledge of the Flask SECRETKEY and write access to the sessions directory,...

CVE-2026-12046

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initialize/sqleditor/updateconnection/// -- were the only routes in the module missing the @pgaloginrequired decorator. Both reach a pickle.loads sink on session'gridData''commandobj':...