https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-48053.htmlhttps://patchthecve.com/cve/CVE-2023-48053.htmlWed, 17 Jun 2026 06:33:34 +0000HIGH 7.5: Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.https://patchthecve.com/cve/CVE-2023-30605.htmlhttps://patchthecve.com/cve/CVE-2023-30605.htmlWed, 17 Jun 2026 05:55:06 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `variable_name` and `variable_value` parameter value in the `sql/instance.py` `param_edit` endpoihttps://patchthecve.com/cve/CVE-2023-30558.htmlhttps://patchthecve.com/cve/CVE-2023-30558.htmlWed, 17 Jun 2026 05:55:01 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `db_name` in the `sql/data_dictionary.py` `table_list` endpoint is passed to the methods that folhttps://patchthecve.com/cve/CVE-2023-30557.htmlhttps://patchthecve.com/cve/CVE-2023-30557.htmlWed, 17 Jun 2026 05:55:01 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `data_dictionary.py` `table_info`. User input coming from the `db_namehttps://patchthecve.com/cve/CVE-2023-30556.htmlhttps://patchthecve.com/cve/CVE-2023-30556.htmlWed, 17 Jun 2026 05:55:01 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `optimize_sqltuningadvisor` method of `sql_optimize.py`. User input cohttps://patchthecve.com/cve/CVE-2023-30555.htmlhttps://patchthecve.com/cve/CVE-2023-30555.htmlWed, 17 Jun 2026 05:55:01 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the `explain` method in `sql_optimize.py`. User input coming from the `db_nhttps://patchthecve.com/cve/CVE-2023-30554.htmlhttps://patchthecve.com/cve/CVE-2023-30554.htmlWed, 17 Jun 2026 05:55:01 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `sql_api/api_workflow.py` endpoint `ExecuteCheck` which passes unfiltehttps://patchthecve.com/cve/CVE-2023-30553.htmlhttps://patchthecve.com/cve/CVE-2023-30553.htmlWed, 17 Jun 2026 05:55:00 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to multiple SQL injections in the `sql_api/api_workflow.py` endpoint `ExecuteCheck`. User inpuhttps://patchthecve.com/cve/CVE-2023-30552.htmlhttps://patchthecve.com/cve/CVE-2023-30552.htmlWed, 17 Jun 2026 05:55:00 +0000MEDIUM 6.5: Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `sql/instance.py` endpoint's `describe` method. In several cases, userhttps://patchthecve.com/cve/CVE-2022-38542.htmlhttps://patchthecve.com/cve/CVE-2022-38542.htmlWed, 17 Jun 2026 04:56:48 +0000CRITICAL 9.8: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.https://patchthecve.com/cve/CVE-2022-38541.htmlhttps://patchthecve.com/cve/CVE-2022-38541.htmlWed, 17 Jun 2026 04:56:48 +0000CRITICAL 9.8: Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.https://patchthecve.com/cve/CVE-2022-38540.htmlhttps://patchthecve.com/cve/CVE-2022-38540.htmlWed, 17 Jun 2026 04:56:48 +0000CRITICAL 9.8: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.https://patchthecve.com/cve/CVE-2022-38539.htmlhttps://patchthecve.com/cve/CVE-2022-38539.htmlWed, 17 Jun 2026 04:56:48 +0000CRITICAL 9.8: Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.https://patchthecve.com/cve/CVE-2022-38538.htmlhttps://patchthecve.com/cve/CVE-2022-38538.htmlWed, 17 Jun 2026 04:56:48 +0000CRITICAL 9.8: Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.https://patchthecve.com/cve/CVE-2022-38537.htmlhttps://patchthecve.com/cve/CVE-2022-38537.htmlWed, 17 Jun 2026 04:56:47 +0000CRITICAL 9.8: Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.https://patchthecve.com/cve/CVE-2019-20008.htmlhttps://patchthecve.com/cve/CVE-2019-20008.htmlWed, 17 Jun 2026 02:29:49 +0000MEDIUM 5.4: In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.