{"id":"CVE-2026-121261","aliases":[],"cve":{"records":[{"id":"CVE-2026-121261","source":"VulDB","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-03T10:48:01.248Z","published":"2026-11-03T16:30:15.391Z","modified":"2026-11-07T03:16:04.447Z"}],"publishers":[{"name":"VulDB","role":"CNA","organizationId":"1af790b2-7ee1-4545-860a-a788eba489b5","modified":"2026-11-03T16:30:15.391Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-07T03:16:04.447Z"}],"references":[{"url":"https://vuldb.com/vuln/430227","tags":["vdb-entry","technical-description"],"source":"VulDB"},{"url":"https://vuldb.com/vuln/430227/cti","tags":["signature","permissions-required"],"source":"VulDB"},{"url":"https://vuldb.com/cve/CVE-2026-121261","tags":["third-party-advisory"],"source":"VulDB"},{"url":"https://vuldb.com/submit/1018488","tags":["third-party-advisory"],"source":"VulDB"},{"url":"https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363","tags":["exploit"],"source":"VulDB"}],"weaknesses":[{"id":"CWE-835","description":"Infinite Loop","source":"VulDB"},{"id":"CWE-404","description":"Denial of Service","source":"VulDB"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-07T03:15:54.702805Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"phpMyAdmin ShapeFile SHP File loadFromFile infinite loop","titleSource":"VulDB","descriptionSource":"VulDB","description":"A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","score":5.3,"severity":"medium","published":"2026-11-03T16:30:15.391Z","modified":"2026-11-07T03:16:04.447Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"phpMyAdmin","name":"ShapeFile","platforms":[],"versions":[{"version":"4.0.0","status":"affected"},{"version":"4.0.1","status":"affected"}],"cpes":["cpe:2.3:a:phpmyadmin:shapefile:*:*:*:*:*:*:*:*"],"source":"VulDB","url":"https://www.cve.org/CVERecord?id=CVE-2026-121261"}],"remediation":[],"references":["https://vuldb.com/vuln/430227","https://vuldb.com/vuln/430227/cti","https://vuldb.com/cve/CVE-2026-121261","https://vuldb.com/submit/1018488","https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363"],"sources":[{"name":"CVE","id":"CVE-2026-121261","modified":"2026-11-07T03:16:04.447Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-121261"}],"assessments":[{"source":"VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","score":5.3},{"source":"VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C","score":4.3},{"source":"VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C","score":4.3},{"source":"VulDB","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C","score":5}],"sourceAffected":[],"observedAt":"2026-11-07T03:31:51.827Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-03T16:45:38.934Z","attemptedAt":"2026-11-03T16:45:38.934Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-03T16:45:39.164Z","attemptedAt":"2026-11-03T16:45:39.164Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-03T16:45:39.488Z","attemptedAt":"2026-11-03T16:45:39.488Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-03T16:45:39.073Z","attemptedAt":"2026-11-03T16:45:39.073Z"}],"evidence":[],"aiSummary":{"text":"phpMyAdmin ShapeFile up to version 4.0.1 has an infinite loop vulnerability in the ShapeRecord::loadFromFile function, allowing remote attackers to cause a denial of service. The vendor has not responded to the disclosure. The vulnerability may be exploitable remotely.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T16:41:04.127Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-121261"}]}}