CVE-2009-5026
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running...
CVE-2009-5026 is a medium vulnerability (CVSS 6.8) in Mysql, published August 17, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.76%, the 94th percentile. No source names a fixed version.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 7.76%EPSS, 94th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Oracle MySQL < 5.1.50 - Privilege Escalation | 2010-08-03 |
What each source reports
NVD Score used
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
- Record
CVE-2009-5026- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE ListNo score
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
- Record
CVE-2009-5026- Updated
- 2026-11-02
EUVDEUVD-2009-4984No score
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
- Record
EUVD-2009-4984- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rw88-9fhw-cqr5No score
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running...
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
- Record
GHSA-rw88-9fhw-cqr5- Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=640177
dev.mysql.com/doc/refman/5.0/en/news-5-0-93.html
bugs.mysql.com/bug.php?id=49124
lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html
seclists.org/oss-sec/2011/q4/101
secunia.com/advisories/49179
nvd.nist.gov/vuln/detail/CVE-2009-5026
github.com/advisories/GHSA-rw88-9fhw-cqr5