5621 matches found
CVE-2026-50006
CVE-2026-50006 affects Anyquery (github.com/julien040/anyquery), an SQL query engine built on SQLite. In server mode prior to 0.4.5 , the MySQL-compatible port forwards unauthenticated SQL to SQLite without restricting ATTACH DATABASE filesystem targets. A remote, unauthenticated attacker can spe...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...
CVE-2026-54629
Anyquery (an SQL query engine built on SQLite) prior to 0.4.5 is vulnerable to Local File Read via unrestricted SQLite virtual table modules in server mode. When launched in server mode, the MySQL-compatible port accepts unauthenticated connections that can execute CREATE VIRTUAL TABLE statements...
CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...
CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...
CVE-2025-26794
CVE-2025-26794: Blind SQL injection in Exim 4.98 SQLite DBM - exploit writeup Exim report: https://www.exim.org/static/doc/security/CVE-2025-26794.txt I discovered this vulnerability through a manual code review. Vulnerability details: Issue The SQL parameters, when SQLite is used as the DBM, are...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...
Astra Linux – Vulnerability in SQLite3
SQLite version 3.31.1 allows attackers to cause a denial of service segmentation fault through a malformed window-function query, due to improper handling of the initialization of the AggInfo object...
Astra Linux – Vulnerability in SQLite3
SQLite version 3.32.0 has an integer overflow issue in the sqlite3strvappendf function within printf.c...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles pExpr-y.pTab, as demonstrated by the TKCOLUMN case in sqlite3ExprCodeTarget in expr.c...
Astra Linux – Vulnerability in SQLite3
In SQLite 3.31.1, there is an out-of-bounds access issue involving the ALTER TABLE operation for views that contain nested FROM clauses...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles certain parser-tree rewrites, related to files expr.c, vdbeaux.c, and window.c. This issue is caused by incorrect error handling in the sqlite3WindowRewrite function...
Astra Linux – Vulnerability in SQLite3
The flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN where the right-hand side is a view. This can lead to a NULL pointer dereference or incorrect results...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles certain SELECT statements involving a non-existent VIEW, resulting in an application crash...
Astra Linux – Vulnerability in SQLite3
The zipfileUpdate function in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during the update of a ZIP archive...
Astra Linux – Vulnerability in SQLite3
SQLite version 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c...
Astra Linux – Vulnerability in exim4
Exim 4.98 before 4.98.1 allowed remote SQL injection when SQLite hints and ETRN serialization were used. Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations...