What is the CVSS score of CVE-2024-44905?

CVE-2024-44905 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2024-44905?

Organizations using go-pg pg v10.13.0 should be aware of notable risk from CVE-2024-44905, a SQL injection vulnerability rated CVSS 6.5.. A patch is available.

Is there a public PoC exploit available for CVE-2024-44905?

Yes, a public proof-of-concept exploit is available for CVE-2024-44905. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-44905?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Ubuntu CVE-2024-44905

EUVD-2024-54681 MEDIUM

SQL Injection (CWE-89)

2025-06-12 cve@mitre.org

GHSA-6xp3-p59p-q4fj

SQLi Debian Ubuntu Pg Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Ubuntu

MEDIUM

qualitative

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2024-54681

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

PoC Detected

Jul 09, 2025 - 19:14 vuln.today

Public exploit code

CVE Published

Jun 12, 2025 - 16:15 nvd

MEDIUM 6.5

DescriptionCVE.org

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

Analysis

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

Technical ContextAI

SQL injection occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterized queries.

RemediationAI

Use parameterized queries or prepared statements. Apply input validation and escape special characters. Implement least-privilege database accounts.

More in Pg

View all

CVE-2018-5298 HIGH This Week

7.5 Jan 08

In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with stat

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

9.8

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

Same technique SQLi

View all

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

CVE-2013-0333 HIGH POC

7.5

Vendor StatusVendor

Ubuntu

Priority: Medium

golang-gopkg-pg.v5

Release	Status	Version
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

Bug #1111939

golang-gopkg-pg.v5

Release	Status	Fixed Version	Urgency
bookworm, bullseye, trixie	vulnerable	5.3.3-3.1	-
(unstable)	fixed	(unfixed)	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2024-44905 vulnerability details – vuln.today

Back

Ubuntu CVE-2024-44905

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Pg

Same weakness CWE-89 – SQL Injection

Same technique SQLi

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code