Sign inStart freeBook a demo

MySQL vulnerabilitiesNone on the known-exploited list.

Vendor
The short answer

MySQL has 112 published vulnerabilities across 12 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is MySQL, with 94. If you run MySQL software, patch the exploited flaws first.

See the exploited flaws

We keep watching the known-exploited list.

Products

Which MySQL products have the most vulnerabilities?

MySQL leads with 94 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.

  1. MySQL94
  2. Maxdb10
  3. Community Server4
  4. Eventum2
  5. Mysql Server2
  6. Mysql Community Server2
  7. Winmysqladmin1
  8. Mysql Enterprise Server1
  9. Mysql Eventum0
  10. Mysql Tools0
Published vulnerabilities
Known exploited

Which MySQL vulnerabilities are being exploited?

This is the list that matters most: flaws criminals are using now.

None of MySQL's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.

Exploit likelihood

Which MySQL flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. 92%
    CVE-2008-0226High

    Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2)...

    CVSS7.5Published10 Jan 2008
  2. 78%
    CVE-2003-0780Critical

    Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

    CVSS9.0Published22 Sep 2003
  3. 72%
    CVE-2006-4305Critical

    Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a WebDBM client.

    CVSS10.0Published30 Aug 2006
  4. 70%
    CVE-2004-0627Critical

    The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled string.

    CVSS10.0Published6 Dec 2004
  5. 69%
    CVE-2005-0684Critical

    Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long file parameter after a percent ("%") sign or (2) a...

    CVSS10.0Published25 Apr 2005
  6. 38%
    CVE-2006-1518Medium

    Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.

    CVSS6.5Published5 May 2006
  7. 36%
    CVE-2006-1516Medium

    The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte,...

    CVSS5.0Published5 May 2006
  8. 29%
    CVE-2006-3469Medium

    Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the...

    CVSS4.0Published21 Jul 2006
  9. 26%
    CVE-2006-3081Medium

    mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.

    CVSS4.0Published19 Jun 2006
  10. 22%
    CVE-2004-0835High

    MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could...

    CVSS7.5Published3 Nov 2004
Every product

All MySQL products we track.

11 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.

This directory lists the 11 MySQL products with at least one tracked version, of 12 in our catalogue.

Precursor Intelligence

Running MySQL? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

Our catalogue lists 112 published vulnerabilities across 12 products and 392 versions from MySQL.

None of MySQL's vulnerabilities is on the list of flaws known to be exploited today.

MySQL, with 94 published vulnerabilities. Its own page lists the ones known to be exploited.

Create a Precursor Intelligence account and track the MySQL products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

Keep exploring