Skip to content
OpenAdvisories

Product · julien040

anyquery

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2026-54628

    Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound d…

    julien040 anyquery github.com/julien040/anyquery Go
  • High 7.5
    CVE-2026-54629

    Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or direc…

    julien040 anyquery github.com/julien040/anyquery Go
  • High 7.3
    CVE-2026-47253

    Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

    Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traver…

    julien040 anyquery github.com/julien040/anyquery Go
  • High 7.7
    CVE-2025-61679

    Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data

    Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration dat…

    julien040 anyquery