Mysql_CVE-2024-27766

Exploit Reproduction Guide affected product version MariaDB 11.1 This guide provides step-by-step instructions to reproduce a User-Defined Function UDF attack on a database system. Please note that this exploit may work on some systems, but it might not function correctly on 64-bit architectures ...

CVE-2023-39593

MariaDB 10.5 Authenticated Code execution-sysexec This guide provides detailed instructions to exploit a User-Defined Function UDF vulnerability in MariaDB on a remote server. These steps include downloading and executing malicious code on a vulnerable database system. Warning: This document is f...

CVE-2024-27766

CVE-2024-27766 MariaDB v11.1 RCE via UDF — modified PoC based on Ant1sec-ops/CVE-2024-27766. Overview | ---|--- Affected| MariaDB v11.1 Fixed in| 10.5.25 / 10.6.18 / 10.11.8 / 11.0.6 / 11.1.5 / 11.2.4 / 11.4.2+ Type| RCE via User-Defined Function UDF MariaDB v11.1 allows an attacker with sufficie...

MYSQL-UDF-Exploit

MYSQL-UDF-Exploit MYSQL UDF Exploit...

CVE-2026-32710

CVE-2026-32710 Heap buffer overflow in MariaDBJSONSCHEMAVALID → persistent privilege escalation → UDF RCE | ---|--- Affected| MariaDB 11.4.x confirmed on 11.4.9 Bug| OOB write in jsongetnormalizedstring — strncpy into 128-byte DYNAMICSTRING with no bounds check Impact| SELECT-only user → ALL...

Serious-Sam---CVE-2021-36934-Mitigation-for-Datto-RMM

Overview This is a Datto RMM component to mitigate CVE-2021-36934, aka Serious SAM. It follows the mitigation measures outlined at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 https://kb.cert.org/vuls/id/506989 USE AT YOUR OWN RISK. EXPECT THIS TO BREAK SOME BACKUPS...

UDFPwn-CVE-2012-5613

UDFPwn.py MySQL 4.x/5.0 Linux - User-Defined Function UDF Dynamic Library 2 automation script...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition’s start offset directly from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e., it treats reallocationTableLen as a...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

Fedora 45 : perl-DBI (2026-ea9d9f0e38)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ea9d9f0e38 advisory. Changes for version 1.656 Remove lock file on end of scope Prevent dbiprofile crash CVE-2026-108518 Henrik Teichmann Memory corruption via...

Fedora 44 : perl-DBI (2026-a7ce91a6a0)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7ce91a6a0 advisory. Changes for version 1.656 Remove lock file on end of scope Prevent dbiprofile crash CVE-2026-108518 Henrik Teichmann Memory corruption via...

Fedora 43 : perl-DBI (2026-a95b9f327e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a95b9f327e advisory. Changes for version 1.656 Remove lock file on end of scope Prevent dbiprofile crash CVE-2026-108518 Henrik Teichmann Memory corruption via...

Exasol default SYS credential PYTHON3 UDF RCE

Default sys/exasol over TLS SQL port: CREATE PYTHON3 UDF with os.popen; requires local exaplus client or docker exec into DB container. """Exasol Database 7.1.30 docker-db - Shipped Default SYS Credential Reaching a PYTHON3 UDF os.popen Command Execution with Output Returned Through SELECT...

Apple MacOS: CVE-2026-84498: OS X update for udf

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to disclose kernel memory...

Apple MacOS: CVE-2026-112529: OS X update for udf

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination...

Apple MacOS: CVE-2026-112524: OS X update for udf

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory...

Apple MacOS: CVE-2026-112508: OS X update for udf

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory...

BIT-MARIADB-MIN-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...