Oracle MySQL vulnerabilities
1,330 known vulnerabilities affecting oracle/mysql.
Total CVEs
1,330
CISA KEV
0
Public exploits
50
Exploited in wild
2
Severity breakdown
CRITICAL12HIGH71MEDIUM1066LOW181
Vulnerabilities
Page 10 of 67
CVE-2020-2579P4MEDIUMCVSS 6.5≥ 5.6.0, ≤ 5.6.46≥ 5.7.0, ≤ 5.7.28+1 more2020-01-15
CVE-2020-2579 [MEDIUM] CVE-2020-2579: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerabilit
nvd
CVE-2020-14591P4MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.202020-07-15
CVE-2020-14591 [MEDIUM] CVE-2020-14591: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Suppor
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized abi
nvd
CVE-2024-21230P4MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.39≥ 8.4.0, ≤ 8.4.2+2 more2024-10-15
CVE-2024-21230 [MEDIUM] CWE-400 CVE-2024-21230: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vuln
nvd
CVE-2024-21196P4MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.39≥ 8.4.0, ≤ 8.4.2+2 more2024-10-15
CVE-2024-21196 [MEDIUM] CWE-400 CVE-2024-21196: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulner
nvd
CVE-2024-21171P4MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.37≥ 8.1.0, ≤ 8.4.02024-07-16
CVE-2024-21171 [MEDIUM] CWE-400 CVE-2024-21171: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can res
nvd
CVE-2025-50083P3MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.42≥ 8.4.0, ≤ 8.4.5+1 more2025-07-15
CVE-2025-50083 [MEDIUM] CWE-400 CVE-2025-50083: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability ca
nvd
CVE-2025-50076P3MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.422025-07-15
CVE-2025-50076 [MEDIUM] CWE-400 CVE-2025-50076: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versi
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.25. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to
nvd
CVE-2025-50078P3MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.42≥ 8.4.0, ≤ 8.4.5+1 more2025-07-15
CVE-2025-50078 [MEDIUM] CWE-400 CVE-2025-50078: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versi
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can resu
nvd
CVE-2025-50082P3MEDIUMCVSS 6.5≥ 8.0.0, ≤ 8.0.42≥ 8.4.0, ≤ 8.4.5+1 more2025-07-15
CVE-2025-50082 [MEDIUM] CWE-400 CVE-2025-50082: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability ca
nvd
CVE-2012-2750P4CRITICALCVSS 10.0≥ 5.5.0, < 5.5.232012-08-17
CVE-2012-2750 [CRITICAL] CVE-2012-2750: Unspecified vulnerability in MySQL 5.5.x before 5.5.23 has unknown impact and attack vectors related
Unspecified vulnerability in MySQL 5.5.x before 5.5.23 has unknown impact and attack vectors related to a "Security Fix", aka Bug #59533. NOTE: this might be a duplicate of CVE-2012-1689, but as of 20120816, Oracle has not commented on this possibility.
nvd
CVE-2015-3152P3MEDIUMCVSS 5.9≤ 5.7.22016-05-16
CVE-2015-3152 [MEDIUM] CWE-295 CVE-2015-3152: Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB b
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
nvd
CVE-2016-3486P4MEDIUMCVSS 6.5≥ 5.6.0, ≤ 5.6.30≥ 5.7.0, ≤ 5.7.122016-07-21
CVE-2016-3486 [MEDIUM] CVE-2016-3486: Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote au
Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: FTS.
nvd
CVE-2016-3501P4MEDIUMCVSS 6.5≥ 5.6.0, ≤ 5.6.30≥ 5.7.0, ≤ 5.7.122016-07-21
CVE-2016-3501 [MEDIUM] CVE-2016-3501: Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote au
Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.
nvd
CVE-2014-2436P4MEDIUMCVSS 6.5≥ 5.5.0, ≤ 5.5.36≥ 5.6.0, ≤ 5.6.162014-04-16
CVE-2014-2436 [MEDIUM] CVE-2014-2436: Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows re
Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RBR.
nvd
CVE-2017-3331P4MEDIUMCVSS 6.5v5.7.11v5.7.12+5 more2017-04-24
CVE-2017-3331 [MEDIUM] CVE-2017-3331: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). The support
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). The supported version that is affected is 5.7.11 to 5.7.17. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability
nvd
CVE-2015-2568P4MEDIUMCVSS 5.0≥ 5.5.0, ≤ 5.5.41≥ 5.6.0, ≤ 5.6.222015-04-16
CVE-2015-2568 [MEDIUM] CVE-2015-2568: Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows
Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.
nvd
CVE-2002-1376P4HIGHCVSS 7.5v3.22.26v3.22.27+45 more2002-12-23
CVE-2002-1376 [HIGH] CVE-2002-1376: libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify le
libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.
nvd
CVE-2019-2434P4MEDIUMCVSS 6.5≥ 5.7.0, ≤ 5.7.24≥ 8.0.0, ≤ 8.0.132019-01-16
CVE-2019-2434 [MEDIUM] CVE-2019-2434: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supporte
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in
nvd
CVE-2018-0735P4MEDIUMCVSS 5.9≤ 5.6.42≥ 5.7.0, ≤ 5.7.24+1 more2018-10-29
CVE-2018-0735 [MEDIUM] CWE-327 CVE-2018-0735: The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attac
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
nvd
CVE-2017-3273P4MEDIUMCVSS 6.5≥ 5.6.0, ≤ 5.6.34≥ 5.7.0, ≤ 5.7.162017-01-27
CVE-2017-3273 [MEDIUM] CWE-20 CVE-2017-3273: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported v
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can r
nvd