David-Crty

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

David-Crty records in CISA KEV

No David-Crty vulnerabilities are listed in CISA KEV.

Records

6 records

TI-2026-85050 CVE-2026-121939 · GHSA-3962-28xr-cf4g

Databasement OIDC login bypass lets attackers take over accounts

HIGH 75

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00544 Published 2026-11-04 Fixed in 1.10.9 CWE-290

TI-2026-70800 CVE-2026-108963 · GHSA-7cxh-ppfp-4mq4

Argument injection in databasement allows remote code execution

HIGH 73

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01685 Published 2026-10-11 Fixed in 1.8.2 CWE-88

TI-2026-65723 CVE-2026-103534 · GHSA-fw34-2f32-wm2m

David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

MEDIUM 57

A vulnerability was determined in David-Crty databasement up to 1.7.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-01 Fixed in 1.7.2 CWE-266

TI-2026-76086 CVE-2026-111875 · GHSA-cwj3-qffg-4fm2

Missing authorization in David-Crty Databasement scheduled restore

MEDIUM 56

A vulnerability has been found in David-Crty Databasement up to 1.8.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00227 Published 2026-10-18 Fixed in 1.8.2 CWE-862

TI-2026-65722 CVE-2026-103533 · GHSA-h4ph-4xq3-682r

David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

MEDIUM 44

A vulnerability was found in David-Crty databasement up to 1.7.1.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.0029 Published 2026-10-01 Fixed in 1.7.2 CWE-22

TI-2026-63662 CVE-2026-95654 · GHSA-9cq7-qg25-29v5

Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token

MEDIUM 42

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00514 Published 2026-09-22 Fixed in 1.7.14 CWE-863

Open these records in search →

Critical	2
High	1
Medium	2
Low	1
No CVSS	0