Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108963

Quick assessment

Affected
David-Crty databasement
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

databasement 1.8.2 之前的版本存在远程代码执行漏洞，原因是其以任意经过身份认证的用户可指定的数据库名称运行某些命令（例如 mariadb-dump）。例如，通过传入参数 --result-file=/app/public/index.php 可以将内容写入 index.php 文件。换句话说，尽管引号的使用防止了 mariadb-dump 中的操作系统命令注入，但仅凭参数注入本身已足以间接导致代码执行。注意：该项目的 composer.json 文件并未声明一个独立发布的 databasement

CVSS 8.8 · High EPSS 1.69% · P76

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
David-Crty databasement 1.0.0< 1.8.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108963

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
David-Crty databasement 1.0.0 ~ 1.8.2 -

II. Public POCs for CVE-2026-108963

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108963

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108963 (3)

Vendor Advisories for CVE-2026-108963 (1)

Other References for CVE-2026-108963 (1)

IV. Related Vulnerabilities

Same product: databasement
Same vendor: David-Crty
Same weakness: CWE-88

V. Comments for CVE-2026-108963

No comments yet

Leave a comment