CVE-2023-52082

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.

• CWE-89

• https://github.com/LycheeOrg/Lychee/commit/33354a2ce7cf700cc4ee537b7b8b94dfc1e84ad4Patch
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-rjwv-5j3m-p5x4Vendor Advisory
• https://github.com/LycheeOrg/Lychee/commit/33354a2ce7cf700cc4ee537b7b8b94dfc1e84ad4Patch
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-rjwv-5j3m-p5x4Vendor Advisory

Published

Dec 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52075ReVanced API proxies requests needed to feed the ReVanced Ma…7.5
• CVE-2023-52076Atril Document Viewer is the default document reader of the …7.8
• CVE-2023-52077Nexkey is a lightweight fork of Misskey v12 optimized for sm…9.8
• CVE-2023-52079msgpackr is a fast MessagePack NodeJS/JavaScript implementat…6.5
• CVE-2023-52080IEIT NF5280M6 UEFI firmware through 8.4 has a pool overflow …7.7
• CVE-2023-52081ffcss is a CLI interface to apply and configure Firefox CSS …5.3
• CVE-2023-52083Winter is a free, open-source content management system. Pr…4.8
• CVE-2023-52084Winter is a free, open-source content management system. Pri…5.4
• CVE-2023-52085Winter is a free, open-source content management system. Use…5.4
• CVE-2023-52086resumable.php (aka PHP backend for resumable.js) 0.1.4 befor…8.1
• CVE-2023-5209The WordPress Online Booking and Scheduling Plugin WordPress…4.8
• CVE-2023-52090A security agent link following vulnerability in Trend Micro…7.8