David-Crty has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 6.3 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-108963High· 8.8databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user61CVE-2026-103534Medium· 6.3A vulnerability was determined in David-Crty databasement up to 1.7.147CVE-2026-95654High· 7.4Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance41CVE-2026-111875Medium· 4.7David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization38CVE-2026-103533Medium· 4.1A vulnerability was found in David-Crty databasement up to 1.7.135
David-Crty vulnerabilities
CVEs affecting David-Crty, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-111875Medium· 4.7PoCDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Su…
CVE-2026-108963High· 8.8PoCdatabasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write…
CVE-2026-103534Medium· 6.3PoCA vulnerability was determined in David-Crty databasement up to 1.7.1
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper a…
CVE-2026-103533Medium· 4.1PoCA vulnerability was found in David-Crty databasement up to 1.7.1
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API …
CVE-2026-95654High· 7.4Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can…