https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 05:08:15 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-108963 <p>databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project&#39;s composer.json file does not indicate an independently published databasement Composer package.</p> <p>databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project&#39;s composer.json file does not indicate an independently published databasement Composer package.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-108963 https://vulnerability.circl.lu/vuln/ghsa-7cxh-ppfp-4mq4 <p>databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project&#39;s composer.json file does not indicate an independently published databasement Composer package.</p> <p>databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project&#39;s composer.json file does not indicate an independently published databasement Composer package.</p> https://vulnerability.circl.lu/vuln/ghsa-7cxh-ppfp-4mq4