whodb vulnerabilities
3 known vulnerabilities in whodb from Clidey. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
whodb: Improper Limitation of a Pathname to a Restricted Directory
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials
- 7.5 High severity
whodb: Improper Neutralization of Special Elements in Data Query Logic
WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The applicati
- 9.1 Critical severity
whodb: Improper Limitation of a Pathname to a Restricted Directory
WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present