5621 matches found
CVE-2026-50006
CVE-2026-50006 affects Anyquery (github.com/julien040/anyquery), an SQL query engine built on SQLite. In server mode prior to 0.4.5 , the MySQL-compatible port forwards unauthenticated SQL to SQLite without restricting ATTACH DATABASE filesystem targets. A remote, unauthenticated attacker can spe...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...
CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...
CVE-2026-54629
Anyquery (an SQL query engine built on SQLite) prior to 0.4.5 is vulnerable to Local File Read via unrestricted SQLite virtual table modules in server mode. When launched in server mode, the MySQL-compatible port accepts unauthenticated connections that can execute CREATE VIRTUAL TABLE statements...
CVE-2026-54629 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csvreader and logreader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can...
CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...
CVE-2025-26794
CVE-2025-26794: Exim 4.98（SQLite DBM）中的盲SQL注入 - 漏洞利用分析 Exim 报告：https://www.exim.org/static/doc/security/CVE-2025-26794.txt 我通过手动代码审查发现了此漏洞。 漏洞详细信息： 问题 当 SQLite 被用作 DBM 时，SQL 参数未正确转义。这导致远程用户有可能构造自定义的 SQLite 查询。 前提条件： 使用“USESQLITE = yes”编译 Exim。这将把 SQLite 设为数据库管理器（DBM）。 启用 ETRN...
Astra Linux – Vulnerability in SQLite3
SQLite version 3.31.1 allows attackers to cause a denial of service segmentation fault through a malformed window-function query, due to improper handling of the initialization of the AggInfo object...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...
Astra Linux – Vulnerability in SQLite3
SQLite version 3.32.0 has an integer overflow issue in the sqlite3strvappendf function within printf.c...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles pExpr-y.pTab, as demonstrated by the TKCOLUMN case in sqlite3ExprCodeTarget in expr.c...
Astra Linux – Vulnerability in SQLite3
In SQLite 3.31.1, there is an out-of-bounds access issue involving the ALTER TABLE operation for views that contain nested FROM clauses...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles certain parser-tree rewrites, related to files expr.c, vdbeaux.c, and window.c. This issue is caused by incorrect error handling in the sqlite3WindowRewrite function...
Astra Linux – Vulnerability in SQLite3
The flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN where the right-hand side is a view. This can lead to a NULL pointer dereference or incorrect results...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles certain SELECT statements involving a non-existent VIEW, resulting in an application crash...
Astra Linux – Vulnerability in SQLite3
The zipfileUpdate function in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during the update of a ZIP archive...
Astra Linux – Vulnerability in SQLite3
SQLite version 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c...
Astra Linux – Vulnerability in SQLite3
A flaw was discovered in SQLite’s SELECT query functionality src/select.c. This flaw allows an attacker who is capable of executing SQL queries locally on the SQLite database to cause a denial of service or potentially lead to code execution by triggering a use-after-free. The most significant...