CVE Explorer

CVE-2026-8335

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:26985d7dcdd58e15147a6f1267da92b562cc1052394122706039a89a36fc2cae

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unknown","product":"Aix-DB","repo":"https://github.com/apconw/Aix-DB","vendor":"Aix-DB","versions":[{"lessThanOrEqual":"1.2.4","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:249c85e1f6d6348153ee051a6c40098c5b5a1a2f7e351e2d830efd09430f1a9f · sha256:10bb02deacf1937d… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NO…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:249c85e1f6d6348153ee051a6c40098c5b5a1a2f7e351e2d830efd09430f1a9f · sha256:10bb02deacf1937d… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:249c85e1f6d6348153ee051a6c40098c5b5a1a2f7e351e2d830efd09430f1a9f · sha256:10bb02deacf1937d… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"tags":["third-party-advisory"],"url":"https://cert.pl/posts/2026/06/CVE-2026-8335"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:249c85e1f6d6348153ee051a6c40098c5b5a1a2f7e351e2d830efd09430f1a9f · sha256:10bb02deacf1937d… · /containers/cna/references/1

{"tags":["product"],"url":"https://github.com/apconw/Aix-DB"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:249c85e1f6d6348153ee051a6c40098c5b5a1a2f7e351e2d830efd09430f1a9f · sha256:10bb02deacf1937d… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer