Daily Digest
One-paragraph executive summary, highlighting the single most urgent item (a CISA KEV-confirmed entry always outranks a merely high-CVSS entry, since it's confirmed exploitation vs. theoretical severity).
Among the database assets, the most urgent issue is CVE‑2025‑56157, a critical (CVSS 9.8) vulnerability in Dify’s Docker‑based PostgreSQL deployment that exposes default credentials when the database port is exposed, enabling any network attacker to gain full database access.
Summary: SQL injection via the order_by parameter of the /customers/search endpoint in EasyAppointments ≤ 1.5.1. Unauthenticated attackers can supply a malicious order_by value, causing time‑based queries, schema enumeration, and potentially remote code execution by writing a PHP shell with INTO OUTFILE when MySQL permits file writing.
Affected Features / Interoperability: The web application’s search endpoint and its dynamic ORDER BY clause; exploitation can break application integrity, lead to data leakage, and compromise the underlying server.
Source: https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md, https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/poc.py, https://www.linkedin.com/posts/michael-chesang_cve-securityadvisory-appsec-activity-7360754900827365376-Z-IY, https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md
Actions:
Summary: A boundary check flaw in MariaDB’s CONNECT engine’s DOS table type permits a one‑byte null write beyond a stack buffer when an authenticated user triggers a malformed DOS table, leading to crash or remote code execution.
Affected Features / Interoperability: The CONNECT storage engine’s DOS table handling; impact may disrupt replication, client connections, and overall database availability.
Source: https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8, https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19, https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28, https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13, https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
Actions:
Summary: The mariadb.service unit writes a file at /run/mysqld/wsrep-new-cluster during restart. A database user with FILE privilege and a permissive secure-file-priv can create that file with attacker‑controlled environment values, leading to code execution when the service restarts.
Affected Features / Interoperability: The systemd service unit for MariaDB; exploitation can affect replication and any services that rely on the wsrep cluster restart.
Source: https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e, https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19, https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28, https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13, https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
Actions:
Summary: In phpMyFAQ before 4.1.9, the PdoMysql::escape() function fails to properly handle Unicode right single quotation marks when NO_BACKSLASH_ESCAPES mode is enabled, allowing unauthenticated attackers to inject SQL via the search parameter of the autocomplete API.
Affected Features / Interoperability: The search autocomplete endpoint of phpMyFAQ; exploitation can lead to credential disclosure, record modification, or table deletion.
Source: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385, https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-sql-injection-via-api-autocomplete-search-endpoint, https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98p2-cg7p-h385
Actions:
Summary: Insufficient validation of counts, offsets, lengths, and field boundaries in MariaDB’s FRM metadata while opening binary FRM files can cause out‑of‑bounds reads or writes, leading to server crash or potential code execution.
Affected Features / Interoperability: Binary FRM file handling; impact may disrupt database operation and cause downtime for all connected clients.
Source: https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9, https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19, https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28, https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13, https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9
Actions:
Summary: SQL injection in the login processing module of krupalshah EmployeeRecruitmentSystem (up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe) via the mysql_query call in source/loginprocessing.php, allowing remote attackers to manipulate the email/password argument.
Affected Features / Interoperability: User authentication/login flow; compromise can lead to credential theft, data manipulation, or full system takeover.
Source: https://github.com/xiaotian2023/CVE/issues/1, https://vuldb.com/cve/CVE-2026-108805, https://vuldb.com/submit/963376, https://vuldb.com/vuln/416582, https://vuldb.com/vuln/416582/cti
Actions:
Summary: SQL injection in the forgot‑password handler of krupalshah EmployeeRecruitmentSystem via the mysql_query call in source/authprocessing.php, where the fpemail argument can be manipulated remotely.
Affected Features / Interoperability: Password recovery functionality; exploitation can allow unauthorized data access or modification.
Source: https://github.com/xiaotian2023/CVE/issues/2, https://vuldb.com/cve/CVE-2026-108806, https://vuldb.com/submit/963380, https://vuldb.com/vuln/416583, https://vuldb.com/vuln/416583/cti
Actions:
Summary: SQL injection in the registration handler of krupalshah EmployeeRecruitmentSystem via the mysql_query call in source/adminregister.php, enabling remote manipulation of the argument.
Affected Features / Interoperability: User registration process; compromise can lead to unauthorized account creation or data tampering.
Source: https://github.com/xiaotian2023/CVE/issues/3, https://vuldb.com/cve/CVE-2026-108807, https://vuldb.com/submit/963381, https://vuldb.com/vuln/416584, https://vuldb.com/vuln/416584/cti
Actions:
Summary: Missing authentication on the ID parameter of the remove_announcements.php endpoint in KusalkaSilva Learning‑Management‑System allows any remote attacker to modify or delete announcements.
Affected Features / Interoperability: Announcement management feature; impact includes data tampering and loss of integrity for educational content.
Source: https://github.com/KusalkaSilva/Learning-Management-System/, https://github.com/KusalkaSilva/Learning-Management-System/issues/5, https://vuldb.com/cve/CVE-2026-108921, https://vuldb.com/submit/994370, https://vuldb.com/vuln/416734
Actions:
Summary: SQL injection in the registration form of itsmeravitejak Online‑Examination‑System via the MySQLDB::addNewUser argument “branch” in include/database.php, allowing remote attackers to inject malicious SQL.
Affected Features / Interoperability: User registration and database interaction; exploitation can lead to unauthorized data insertion, modification, or deletion.
Source: https://github.com/itsmeravitejak/Online-Examination-System/, https://github.com/itsmeravitejak/Online-Examination-System/issues/3, https://vuldb.com/cve/CVE-2026-108970, https://vuldb.com/submit/999472, https://vuldb.com/vuln/416788
Actions:
Summary: Default PostgreSQL credentials are shipped in Dify Docker compose files up to version 1.5.1; if the container exposes port 5432, any network user can log in with the published username and password, gaining full database access.
Affected Features / Interoperability: Direct database access via PostgreSQL; compromise can lead to data breach, unauthorized modifications, and further attacks on connected services.
Source: https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd, https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161, https://github.com/langgenius/dify, https://github.com/langgenius/dify/issues/15285, https://github.com/langgenius/dify/pull/15286
Actions:
Summary: In PHP PDO PostgreSQL driver versions before the patched releases, an invalid character sequence in a prepared statement can cause the quoting function to return NULL, leading to a null‑pointer dereference and potential server crash.
Affected Features / Interoperability: PHP applications using PDO with PostgreSQL; the issue affects availability of the database server when such statements are sent.
Source: https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj
Actions:
Summary: Parse Server versions before 8.6.96 (and 9.0.0 before 9.10.2‑alpha.5) share transactional batch state across concurrent requests, causing other clients’ acknowledged writes to be rolled back and PostgreSQL transactions to remain open, leading to write failures.
Affected Features / Interoperability: Transactional batch requests in Parse Server; impacts PostgreSQL and MongoDB replica sets and sharded clusters, causing denial of service for write operations.
Source: https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv, https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference
Actions:
Summary: Tabularis through version 0.27.0 contains an authorization bypass in the MCP run_query safety gate, allowing trusted MCP clients or prompt‑injected agents to execute side‑effecting SELECT statements (e.g., setval, nextval, query_to_xml) and modify data without approval.
Affected Features / Interoperability: MCP (Meta‑Control‑Protocol) query execution; can affect data integrity and replication if used to change sequence values or execute DML via XML queries.
Source: https://github.com/TabularisDB/tabularis, https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/ai_activity.rs#L357-L416, https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/mcp/mod.rs#L1136-L1171, https://hackmd.io/@haind/S1BofaIsMx, https://www.vulncheck.com/advisories/tabularis-through-0.27.0-read-only-bypass-via-mcp-run-query-select-classification
Actions:
Summary: Telegram‑Stremio stores operator session strings in MongoDB using a reversible, keyless encoding; attackers with DB access can decode the string and obtain a fully authenticated Telegram session, bypassing two‑step verification.
Affected Features / Interoperability: Session storage mechanism; compromise enables full account takeover and unauthorized messaging, affecting user privacy and service integrity.
Source: https://gist.github.com/mansurmavlankulov/489554cad7b38e07b9651c217f00fffb, https://www.vulncheck.com/advisories/telegram-stremio-insecure-session-storage-via-encode-string
Actions:
Summary: MongoDB Server’s collection validation feature may mishandle certain validator expressions, causing the server process to crash when a document is later inserted, affecting authenticated write users.
Affected Features / Interoperability: Collection validation logic; potential server crash can disrupt all database operations for users relying on that collection.
Source: https://jira.mongodb.org/browse/SERVER-131412
Actions:
Summary: In mongos (the sharded cluster router), an authenticated readWrite user can craft an aggregation pipeline that triggers an internal aggregation stage lacking proper authorization, leading to a crash and denial of service for all clients routed through that mongos instance.
Affected Features / Interoperability: Sharded cluster routing; a crash in mongos can interrupt query processing for all connected clients, causing service outage.
Source: https://jira.mongodb.org/browse/SERVER-131411
Actions:
Summary: Same as PostgreSQL entry: Parse Server transactional batch state sharing causes write interference and indefinite open transactions on PostgreSQL or MongoDB clusters, resulting in write failures.
Affected Features / Interoperability: Transactional batch requests in Parse Server; impacts PostgreSQL and MongoDB replica sets and sharded clusters, causing write failures and potential denial of service.
Source: https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv, https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference
Actions:
Summary: Use of freed memory in MongoDB’s aggregation feature with a batch size of 0 can cause the server to read from memory after it has been released, leading to corrupted query results or unexpected process termination.
Affected Features / Interoperability: Aggregation queries with batch size 0; potential data corruption or service crash affecting all clients that issue such queries.
Source: https://jira.mongodb.org/browse/SERVER-132946
Actions:
Summary: Same as CVE‑2026‑104005: an authenticated readWrite user can craft a malicious aggregation pipeline in mongos that lacks proper authorization, causing the mongos process to crash and deny service to all clients.
Affected Features / Interoperability: Sharded cluster routing (mongos); crash leads to service outage for all routed clients.
Source: https://jira.mongodb.org/browse/SERVER-130431
Actions:
Summary: An issue in MongoDB’s aggregation framework can cause constant values to be handled incorrectly during internal query rewriting, resulting in authenticated read‑only users receiving unintended field values in aggregation output.
Affected Features / Interoperability: Aggregation framework output; may lead to data integrity issues where clients receive unexpected information.
Source: https://jira.mongodb.org/browse/SERVER-134618
Actions:
Oracle Database
User Safety: safe