Database Security

abraxas/sqlite-cli-recover

SQLite 3.53.4 CLI - High - Local - Command injection - recover dump emits hostile schema as dot-command

abraxas/mysql-set-role-leftover

MySQL Community Server 26.7.0 - High - SET ROLE ALL EXCEPT leftover FILE - mysqld UID write

abraxas/postgres-basebackup-symlink

PostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475

abraxas/sqlite-session-ncol

SQLite 3.53.4 - High - Local - heap OOB write - session changeset same-name nCol growth

yym8538/cve-2026-0603

Proof-of-concept and Docker lab reproducing CVE-2026-0603, a second-order SQL injection in Hibernate ORM bulk DELETE/UPDATE operations, with…

abraxas/stirling-h2-import-leftover

Stirling-PDF v3.2.0 - Critical - Remote - H2 RUNSCRIPT leftover - CREATE OR REPLACE ALIAS import-database

abraxas/sqlite-cte-nest

SQLite 3.53.4 - High - Local - Crash - nested CTEs skip nNestSel view-depth cap

abraxas/mysql-mysqldump-tab-path

MySQL Community Server 26.7.0 - High - mysqldump --tab path leftover - client file write

abraxas/phpmyadmin-auth-plugin-unquoted

phpMyAdmin 5.2.3 - High - Remote - SQLi - auth plugin identifier unquoted

abraxas/sqlite-collate-depth

SQLite 3.53.4 - High - Local - Crash - COLLATE chain skips SQLITE_LIMIT_EXPR_DEPTH

abraxas/mysql-jdv-definer-sqli

MySQL Community Server 26.7.0 - High - JSON Duality DEFINER SQLi - NO_BACKSLASH_ESCAPES

abraxas/spark-jdbc-serde-url

Apache Spark 4.2.0 - High - Remote - JDBC URL injection - ALTER TABLE SET SERDEPROPERTIES

abraxas/phpmyadmin-designer-json-sqli

phpMyAdmin 5.2.3 - High - Remote - SQLi - Designer JSON unsanitized identifiers

abraxas/cakephp-window-sqli

CakePHP 5.4.2 - High - Remote - SQLi - WindowExpression range/frame offsets spliced into SQL

abraxas/cakephp-collate-sqli

CakePHP 5.4.2 - High - Remote - SQLi - COLLATE collation is a raw SQL fragment

abraxas/sqlite-values-union

SQLite 3.53.4 - High - Local - Crash - VALUES UNION ALL fallback cleanup stack overflow