Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 10:13:23 +0000 CVE-2026-113605 — Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database https://db.gcve.eu/vuln/cve-2026-113605 <p><strong>Affected:</strong> Stirling-Tools Stirling-PDF</p> <p>Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.</p> <p><strong>Affected:</strong> Stirling-Tools Stirling-PDF</p> <p>Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.</p> https://db.gcve.eu/vuln/cve-2026-113605