Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

CVE-2025-27018

Apache Airflow MySQL Provider: SQL injection in MySQL provider core function

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache-airflow-providers-mysql
CVE-2023-22884

Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

CVSS 3.1 · 9.8 Critical EPSS 11.9% KEV · Not listed
Vendors
Apache
Products
Airflow Apache-airflow-providers-mysql