CVE-2026-51936

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus the function temporarily clears defensive restrictions during operation. A vulnerability in the handling of the source database name parameter made it possible for a caller to supply a crafted source name, which could execute statements that defensive mode would otherwise block. This could allow direct modifications to the sqlite_schema table and database corruption. SQLCipher 4.15.0 now strictly validates the source database name and prevents the bypass.

• CWE-89

• https://github.com/sqlcipher/sqlcipher/commit/30842cda35c88cdfc7a8adba1c9b20821d2c08d1
• https://www.zetetic.net/blog/2026/04/28/sqlcipher-4.15.0-release/

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-51923An Insecure Direct Object Reference (IDOR) vulnerability exi…8.1
• CVE-2026-51924An issue in docuForm GmbH Client v.11.11c allows a remote at…8.1
• CVE-2026-51925A Local File Inclusion (LFI) vulnerability exists in docuFor…8.1
• CVE-2026-51926An issue in docuForm GmbH FSM Client v.11.11c allows a remot…7.5
• CVE-2026-5193The Essential Addons for Elementor – Popular Elementor Templ…6.5
• CVE-2026-51934Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Tec…9.8
• CVE-2026-51937An issue in Oneblog V2.3.9 allows a remote attacker to obtai…7.5
• CVE-2026-5194Missing hash/digest size and OID checks allow digests smalle…9.1
• CVE-2026-51946SQL Injection vulnerability in GoAdminGroup GoAdmin (last re…6.5
• CVE-2026-51947An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi…9.8
• CVE-2026-5195A flaw has been found in code-projects Student Membership Sy…7.3
• CVE-2026-51953An issue in FeehiCMS v.2.1.1 allows an attacker to escalate …7.4