CVE-2026-33545

MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.

• CWE-89

• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6f8a43c1b78d21cfbd7186aaafa7f622d990e0f1Patch
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.6Release Notes
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-hqjr-43r5-9q58Exploit, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3354The Wikilookup plugin for WordPress is vulnerable to Stored …4.4
• CVE-2026-33540Distribution is a toolkit to pack, ship, store, and deliver …7.5
• CVE-2026-33541TSPortal is the WikiTide Foundation’s in-house platform used…6.5
• CVE-2026-33542Incus is a system container and virtual machine manager. Pri…4.8
• CVE-2026-33543FOSSBilling is a free, open-source billing and client manage…9.3
• CVE-2026-33544Tinyauth is an authentication and authorization server. Prio…7.7
• CVE-2026-33548Mantis Bug Tracker (MantisBT) is an open source issue tracke…6.1
• CVE-2026-33549SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended p…8.8
• CVE-2026-3355The Customer Reviews for WooCommerce plugin for WordPress is…6.1
• CVE-2026-33550SOGo before 5.12.5 does not renew the OTP if a user disables…2.6
• CVE-2026-33551An issue was discovered in OpenStack Keystone 14 through 26 …5.3
• CVE-2026-33552Northern.tech Mender Enterprise Server before 4.1.1 has Inco…3.7