MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.
Severity
Low 3.6
Published
18 Aug 2006
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Exploit chance
3.1% in the next 30 daysHigher than 87% of CVEs. EPSS by FIRST, 12 Nov 2026
Attack
Over the network · Only under certain conditions · Needs a login
Attacker can
Read some data · Change some data
CVSS vector
AV:N/AC:H/Au:S/C:P/I:P/A:N
Sources
NVD
Affected software
Software
Affected versions
MySQLServers and applications · cpe:a:oracle:mysql