SQLite

CVEs (73)

• CVE-2025-29088MedApr 10, 2025
  SQLite

  SQLite
  risk 0.00cvss 5.6epss 0.00

  In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

• CVE-2019-19959HigJan 3, 2020
  SQLite

  SQLite
  risk 0.00cvss 7.5epss 0.03

  ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.

• CVE-2019-20218HigJan 2, 2020
  SQLite

  SQLite
  risk 0.00cvss 7.5epss 0.04

  selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

• CVE-2019-19646CriDec 9, 2019
  SQLite

  SQLite
  risk 0.00cvss 9.8epss 0.05

  pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

• CVE-2019-19645MedDec 9, 2019
  SQLite

  SQLite
  risk 0.00cvss 5.5epss 0.01

  alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

• CVE-2015-6607Oct 6, 2015
  SQLite

  SQLite
  risk 0.00cvss —epss 0.02

  SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.

• CVE-2013-7443Aug 12, 2015
  SQLite

  SQLite
  risk 0.00cvss —epss 0.03

  Buffer overflow in the skip-scan optimization in SQLite 3.8.2 allows remote attackers to cause a denial of service (crash) via crafted SQL statements.

• CVE-2015-3717Jul 3, 2015
  SQLite

  SQLite
  risk 0.00cvss —epss 0.05

  Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

• CVE-2015-3416Apr 24, 2015
  SQLite

  SQLite
  risk 0.00cvss —epss 0.06

  The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or…

• CVE-2015-3415Apr 24, 2015
  SQLite

  SQLite
  risk 0.00cvss —epss 0.05

  The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as…

• CVE-2015-3414Apr 24, 2015
  SQLite

  SQLite
  risk 0.00cvss —epss 0.05

  SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE…

• CVE-2008-6589Apr 3, 2009
  Lightneasy

  Lightneasy
  risk 0.00cvss —epss 0.01

  Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php.

• CVE-2007-1888Apr 6, 2007
  PHP

  PHP
  risk 0.00cvss —epss 0.03

  Buffer overflow in the sqlite_decode_binary function in src/encode.c in SQLite 2, as used by PHP 4.x through 5.x and other applications, allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter. NOTE: some PHP installations use a…