Servers and applications
CVE-2009-5026 The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
Severity Medium 6.8
Published 17 Aug 2012
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 7.8% in the next 30 daysHigher than 94% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Read some data · Change some data · Slow it down
CVSS vector AV:N/AC:M/Au:N/C:P/I:P/A:P
Sources NVD Affected software Software Affected versions MySQLServers and applications · cpe:a:oracle:mysql Version 5.1.49-sp1 Version 5.1.49 Version 5.1.48 Version 5.1.47 All 64 release lines Version 5.0.23 Version 5.0.41 Version 5.0.45 Version 5.0.51 Version 5.0.67 Version 5.0.75 Version 5.0.77 Version 5.0.81 Version 5.0.83 Version 5.0.85 Version 5.0.86 Version 5.0.88 Version 5.0.89 Version 5.0.90 Version 5.0.91 Version 5.0.92 Version 5.1 Version 5.1.1 Version 5.1.2 Version 5.1.3 Version 5.1.4 Version 5.1.10 Version 5.1.11 Version 5.1.12 Version 5.1.13 Version 5.1.14 Version 5.1.15 Version 5.1.16 Version 5.1.17 Version 5.1.18 Version 5.1.19 Version 5.1.20 Version 5.1.21 Version 5.1.22 Version 5.1.23-a Version 5.1.24 Version 5.1.25 Version 5.1.26 Version 5.1.27 Version 5.1.28 Version 5.1.29 Version 5.1.30 Version 5.1.31-sp1 Version 5.1.33 Version 5.1.34-sp1 Version 5.1.35 Version 5.1.36 Version 5.1.37-sp1 Version 5.1.38 Version 5.1.39 Version 5.1.40 Version 5.1.40-sp1 Version 5.1.41 Version 5.1.42 Version 5.1.43 Version 5.1.43-sp1 Version 5.1.44 Version 5.1.45 Version 5.1.46 Version 5.1.46-sp1 Version 5.1.47 Version 5.1.48 Version 5.1.49 Version 5.1.49-sp1
References NVD https://nvd.nist.gov/vuln/detail/CVE-2009-5026 CVE.org https://www.cve.org/CVERecord?id=CVE-2009-5026