CVE-2026-108963High· 8.8▾ MidnightPoC availabledatabasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.7%
Exploit / PoC code exists
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111875Medium· 4.7David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
CVE-2026-103534Medium· 6.3A vulnerability was determined in David-Crty databasement up to 1.7.1
CVE-2026-103533Medium· 4.1A vulnerability was found in David-Crty databasement up to 1.7.1
CVE-2026-95654High· 7.4Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance
CVE-2026-112900Critical· 9.2Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-104715High· 7.8Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass