VYPR
← MySQL

Vendor CVEs

MySQL

All CVEs

188 total · sorted by risk
  • CVE-2024-29401CriMar 26, 2024
    MySQL
    MySQL
    risk 0.64cvss 9.8epss 0.01

    xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.

  • CVE-2017-14481CriMay 9, 2018
    MySQL
    Multi-Master Replication Manager
    risk 0.64cvss 9.8epss 0.06

    In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the…

  • CVE-2017-14480CriMay 9, 2018
    MySQL
    Multi-Master Replication Manager
    risk 0.64cvss 9.8epss 0.06

    In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the…

  • CVE-2017-14478CriMay 9, 2018
    MySQL
    Multi-Master Replication Manager
    risk 0.64cvss 9.8epss 0.06

    In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the…

  • CVE-2017-14477CriMay 9, 2018
    MySQL
    Multi-Master Replication Manager
    risk 0.64cvss 9.8epss 0.06

    In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the…

  • CVE-2017-14475CriMay 9, 2018
    MySQL
    Multi-Master Replication Manager
    risk 0.64cvss 9.8epss 0.06

    In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the…

  • CVE-2017-14474CriMay 9, 2018
    MySQL
    Multi-Master Replication Manager
    risk 0.64cvss 9.8epss 0.06

    In the MMM::Agent::Helpers::_execute function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1, a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\_agentd process.…

  • CVE-2025-5662CriSep 2, 2025
    MySQL
    MySQL JDBC Driver
    risk 0.57cvss 9.8epss 0.01

    A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The…

  • CVE-2017-15945HigOct 27, 2017
    MySQL
    MySQL
    risk 0.51cvss 7.8epss 0.00

    The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging…

  • CVE-2002-0969HigOct 11, 2002
    MySQL
    MySQL
    risk 0.51cvss 7.8epss 0.01

    Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the…

  • CVE-2016-1251HigNov 29, 2016
    MySQL
    MySQL
    risk 0.46cvss 8.1epss 0.03

    There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.

  • CVE-2026-60183MedJul 21, 2026
    MySQL
    Mysql Cluster
    risk 0.42cvss 6.4epss 0.00

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit…

  • CVE-2026-21968MedJan 20, 2026
    MySQL
    Server
    risk 0.42cvss 6.5epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple…

  • CVE-2026-21950MedJan 20, 2026
    MySQL
    Server
    risk 0.42cvss 6.5epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.…

  • CVE-2026-21949MedJan 20, 2026
    MySQL
    Server
    risk 0.42cvss 6.5epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.…

  • CVE-2024-21262MedOct 15, 2024
    MySQL
    MySQL Connectors
    risk 0.42cvss 6.5epss 0.01

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 9.0.0 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL…

  • CVE-2020-14765MedOct 21, 2020
    MySQL
    Server
    risk 0.42cvss 6.5epss 0.03

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple…

  • CVE-2020-2780MedApr 15, 2020
    MySQL
    Server
    risk 0.42cvss 6.5epss 0.02

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple…

  • CVE-2010-4177MedNov 12, 2019
    MySQL
    mysql-gui-tools
    risk 0.36cvss 5.5epss 0.00

    mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.

  • CVE-2010-4178MedNov 6, 2019
    MySQL
    mysql-administrator
    risk 0.36cvss 5.5epss 0.00

    MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console

  • CVE-2018-3187MedOct 17, 2018
    MySQL
    Server
    risk 0.36cvss 5.5epss 0.03

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2017-10277MedOct 19, 2017
    MySQL
    MySQL Connectors
    risk 0.35cvss 5.4epss 0.02

    Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Net). Supported versions that are affected are 6.9.9 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise…

  • CVE-2026-21929MedJan 20, 2026
    MySQL
    Server
    risk 0.34cvss 5.3epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. …

  • CVE-2026-34319MedApr 21, 2026
    MySQL
    Mysql Shell
    risk 0.33cvss 5.0epss 0.00

    Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where…

  • CVE-2025-30224MedApr 1, 2025
    Mydumper
    Mydumper
    risk 0.33cvss —epss 0.01

    MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to LOAD LOCAL INFILE query, leading to sensitive information disclosure when clients…

  • CVE-2026-21964MedJan 20, 2026
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2026-21952MedJan 20, 2026
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. …

  • CVE-2026-21948MedJan 20, 2026
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2026-21941MedJan 20, 2026
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2026-21937MedJan 20, 2026
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols…

  • CVE-2026-21936MedJan 20, 2026
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to…

  • CVE-2021-2180MedApr 22, 2021
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.03

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to…

  • CVE-2020-14869MedOct 21, 2020
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.02

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2020-2814MedApr 15, 2020
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.03

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2018-3161MedOct 17, 2018
    MySQL
    Server
    risk 0.32cvss 4.9epss 0.03

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple…

  • CVE-2026-46936MedJul 21, 2026
    MySQL
    Mysql Cluster
    risk 0.29cvss 4.4epss 0.00

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability…

  • CVE-2020-2760MedApr 15, 2020
    MySQL
    Server
    risk 0.29cvss 5.5epss 0.03

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to…

  • CVE-2019-14939MedAug 12, 2019
    MySQL
    MySQL
    risk 0.29cvss 5.5epss 0.00

    An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.

  • CVE-2026-21965LowJan 20, 2026
    MySQL
    Server
    risk 0.18cvss 2.7epss 0.00

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL…

  • CVE-2008-0226Jan 10, 2008
    MySQL
    MySQL
    risk 0.10cvss —epss 0.92

    Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.

  • CVE-2009-4484Dec 30, 2009
    MySQL
    MySQL
    risk 0.09cvss —epss 0.70

    Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to…

  • CVE-2006-4305Aug 30, 2006
    SAP
    DB
    risk 0.09cvss —epss 0.71

    Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.

  • CVE-2004-0627Dec 6, 2004
    MySQL
    MySQL
    risk 0.09cvss —epss 0.70

    The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled string.

  • CVE-2003-0780Sep 22, 2003
    MySQL
    MySQL
    risk 0.09cvss —epss 0.78

    Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

  • CVE-2005-0684Apr 25, 2005
    MySQL
    Maxdb
    risk 0.08cvss —epss 0.69

    Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent ("%") sign or (2) a long Lock-Token string to the WebDAV functionality, which is…

  • CVE-2003-0150Mar 24, 2003
    MySQL
    MySQL
    risk 0.07cvss —epss 0.45

    MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.

  • CVE-2012-5613Dec 3, 2012
    MariaDB
    MariaDB
    risk 0.06cvss —epss 0.32

    MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege…

  • CVE-2006-1516May 5, 2006
    MySQL
    MySQL
    risk 0.06cvss —epss 0.36

    The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.

  • CVE-2006-1518May 5, 2006
    MySQL
    MySQL
    risk 0.06cvss —epss 0.38

    Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.

  • CVE-2006-3469Jul 21, 2006
    MySQL
    MySQL
    risk 0.05cvss —epss 0.27

    Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later…

Page 1 of 4