Browse / MariaDB

MariaDB

See its reports on the map

Attack surface: 67 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to MariaDB

• Memory Corruption23
• Denial of Service7
• Access Control6
• SQL Injection5
• Cryptography4
• Other weaknesses4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Grafana LFI on https://grafana.mariadb.orgRemote File Inclusion · medium
   73 votes
2. Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on ClientStack Overflow · critical
   51 votes
3. Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijackingOut-of-bounds Read · high
   43 votes
4. MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeoverImproper Access Control - Generic · high
   35 votes
5. Connector/C Out-of-bounds read in `unpack_fields()` from short metadata fieldOut-of-bounds Read
   31 votes
6. Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacketUncontrolled Resource Consumption · medium
   31 votes
7. Path Traversal in mbstream ExtractPath Traversal · high
   29 votes
8. MariaDB CLI Utility IssuesSQL Injection
   27 votes
9. MariaDB HandlerSocket Improper Request Field-Count Validation Causes Server CrashUncontrolled Resource Consumption · medium
   23 votes
10. Stack Buffer-Overflow in MariaDB Charset_collation_map_st::insert_or_replace()Stack Overflow
    23 votes
11. libmariadb ( mariadb-connector-c ): stack overflow via server-controlled field->length in prepared-statement codecStack Overflow · medium
    23 votes
12. SSRF on jira.mariadb.orgServer-Side Request Forgery (SSRF) · medium
    21 votes
13. scripts loader (denial of service) vulnerabilityUncontrolled Resource Consumption · low
    20 votes
14. DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalationImproper Access Control - Generic · high
    19 votes
15. Server crash (stack-overflow DoS) via unbounded recursion in MariaDB WKB GEOMETRYCOLLECTION parserMemory Corruption - Generic · medium
    18 votes
16. Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire ServerStack Overflow · medium
    18 votes
17. Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tablesStack Overflow
    16 votes
18. MariaDB Low-Privilege User Can Exhaust Memory Through a Formatting Function and Crash the ServiceUncontrolled Resource Consumption · medium
    16 votes
19. Heap Memory Disclosure via Integer Underflow in Item_func_json_arrayagg::cut_max_length in MariaDB ServerBuffer Over-read
    16 votes
20. CRLF injection at https://mariadb.org/.CRLF Injection · medium
    16 votes
21. Vulnerability Report - Missing Certificate Authority Authorization ruleCryptographic Issues - Generic · low
    16 votes
22. Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-readUse After Free · critical
    14 votes
23. Missing FILE-privilege enforcement in CONNECT file UDFs allows server-side file read and writeImproper Access Control - Generic · high
    14 votes
24. Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEPInteger Underflow · medium
    14 votes
25. Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failureImproper Certificate Validation
    12 votes
26. Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB ServerUse After Free
    12 votes
27. Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM)Classic Buffer Overflow
    11 votes
28. xmlrpc.php on mariadb.org can lead to DDOS and brute force attacksUncontrolled Resource Consumption · low
    10 votes
29. KILL authorization trusts the presented login name instead of the authenticated anonymous accountIncorrect Calculation of Buffer Size
    9 votes
30. Named pipe connection inteceptionBusiness Logic Errors · high
    9 votes
31. Ubuntu/Debian installation method allows key poisoning and code execution for network attackerCryptographic Issues - Generic · medium
    9 votes
32. Github wiki is editable by anyoneImproper Access Control - Generic · medium
    9 votes
33. vulnerable to Cross-site Request Forgery | JiraCross-Site Request Forgery (CSRF) · low
    9 votes
34. ACL cache collision lets a role inherit privileges from a same-named socket userImproper Authentication - Generic · medium
    8 votes
35. DATA / INDEX DIRECTORY Abuse
    8 votes
36. Git Configmedium
    8 votes
37. smtp service vulnerable to POODLE SSLv3Cryptographic Issues - Generic · low
    8 votes
38. Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the serverOut-of-bounds Read · medium
    7 votes
39. Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds writeMemory Corruption - Generic · medium
    7 votes
40. CRLF injection on https://buildbot.mariadb.orgCRLF Injection · medium
    7 votes
41. Connector/ODBC: MADB_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB_StmtExecute, so the next paramset reads out of boundsOut-of-bounds Read · medium
    6 votes
42. Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array ReallocationUse After Free · high
    6 votes
43. MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletionHeap Overflow · medium
    6 votes
44. Connector/C Out-of-bounds read from unterminated GSSAPI SPN in `parse_server_packet()`Out-of-bounds Read
    6 votes
45. Privilege escalation via user controlled usernames / roles and viewsPrivilege Escalation
    6 votes
46. Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result pathOut-of-bounds Read · medium
    6 votes
47. r2dbc-mariadb Parsec auth: server-controlled PBKDF2 iteration count causes CPU-exhaustion DoS ( regression from b7766de )Uncontrolled Resource Consumption · medium
    6 votes
48. [downloads.mariadb.org] CRLF injection in case of encoded query markCRLF Injection · medium
    6 votes
49. Incorrect Permission Assignment for Critical ResourcePrivilege Escalation · medium
    6 votes
50. #mysql50# legacy alias / internal table collisions
    5 votes
51. #mysql50# legacy alias / stale table cache identity mismatch
    5 votes
52. `SHOW [CREATE|GRANTS] ...` / `mariadb-dump` Unescaped SQL GenerationSQL Injection
    5 votes
53. Connector/C++ ignores allowMultiQueries and injects savepoint names into SQLSQL Injection · medium
    4 votes
54. Path traversal in command line clientPath Traversal · medium
    4 votes
55. r2dbc-mariadb: server message accepted with no command in flight desynchronises the connection and serves one user's rows to anotherInformation Disclosure · medium
    3 votes
56. Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every callType Confusion · medium
    3 votes
57. Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded nameStack Overflow · medium
    3 votes
58. Connector/C++ string escaper re-escapes its own output, enabling SQL injectionSQL Injection · medium
    3 votes
59. Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhereSQL Injection · medium
    2 votes
60. Connector/C++ aborts client process on server session-tracking packet via std::stoiUncontrolled Resource Consumption · medium
    2 votes