Vulnerabilities

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified.

A vulnerability has been found in David-Crty Databasement up to 1.8.1.

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user.

A vulnerability was determined in David-Crty databasement up to 1.7.1.

A vulnerability was found in David-Crty databasement up to 1.7.1.

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance.