PostgreSQL

JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. Exploitation enables overwriting the system zone's JWT signing key, forging tokens claiming admin and administrator scopes, and cascading into full UAA and Cloud Foundry compromise; no public exploit has been identified at time of analysis, though the Changed-Scope CVSS vector and PR:H signal a high-severity, low-noise attack path against MySQL-backed deployments.

SQL injection in TypeORM's SelectQueryBuilder.distinctOn enables database enumeration against PostgreSQL-backed applications that pass client-controlled values into the API without validation. The distinctOn array is joined and interpolated verbatim into a SELECT DISTINCT ON (...) clause in src/query-builder/SelectQueryBuilder.ts, bypassing the driver's escape helper and the allowlist guard (validateOrderByCondition) that protects the orderBy family. Because the injection point is a parenthesized SQL expression list, attackers can supply correlated subqueries and perform boolean or time-based blind inference against any table reachable by the application's database role, independent of the queried entity. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.

Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.

SQL injection and chained code injection in baserCMS before 5.3.0 allow authenticated administrators to exfiltrate arbitrary data from a PostgreSQL backend via BcDatabaseService.php. The attack chains two flaws: a backup restore mechanism that unconditionally executes PHP code outside class definitions in schema files upon loading, enabling an admin to plant malicious table names, which are then passed unsanitized into SQL statements across sequence update, CSV export, and table management operations. Error-based SQL injection against the PostgreSQL backend can then retrieve database version, schema contents, and sensitive application data. No public exploit has been identified and this CVE is not in CISA KEV, but the VulnCheck advisory provides sufficient technical detail to guide exploitation by motivated actors.

Incomplete assistant authorization in langgraph-api (LangGraph Server) versions before 0.10.0 allows an authenticated low-privileged user to bypass ownership controls during run creation and access private assistants belonging to other users. The flaw arises because the run-creation code path dispatched the wrong authorization event (`assistants.search` instead of `assistants.read`), causing custom auth handlers registered only for `assistants.read` to be silently bypassed, the ownership filter to be omitted from the database query, and sensitive assistant `metadata`, `config`, and `context` to be returned in plaintext via the API response. No public exploit code exists and the vendor reports no evidence of exploitation in the wild.

SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings without defensive identifier quoting. Operators using the Postgres backend in affected versions are directly impacted; the CVSS 4.0 vector (PR:H, AT:P) reflects that the current vulnerable code path requires operator-level control over schema configuration, though the unsafe pattern creates latent risk if schema names are ever derived from tenant or request input. No public exploit code exists and no CISA KEV listing has been identified; the vendor-released patch in 0.9.0a2 resolves the issue by adding identifier quoting and regression coverage.

Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.

SQL injection in Budibase's PostgreSQL datasource connector allows an authenticated administrator to execute arbitrary DDL and DML statements against the connected PostgreSQL database by supplying a crafted schema name containing embedded double quotes. The vulnerable code in packages/server/src/integrations/postgres.ts interpolates the schema field directly into a SET search_path statement using the simple query protocol, which permits semicolon-delimited multi-statement execution. Impact includes full database read and write access - including extraction of pg_shadow password hashes and potential OS-level file reads via pg_read_file(). No public exploit or CISA KEV listing identified at time of analysis; however, the GHSA advisory provides a complete, step-by-step reproduction procedure making this trivially reproducible. Fixed in version 3.39.19.

Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.

Hardcoded PostgreSQL credentials embedded in openssl_encrypt standalone server configuration files expose backend databases to unauthorized access in all versions before 1.4.0. Network-adjacent attackers who obtain the well-known static credentials - trivially available from the distributed software package or public advisory - can authenticate directly to the PostgreSQL instance and retrieve sensitive stored data without any legitimate account. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the CWE-798 root cause makes exploitation mechanically trivial for any attacker within network reach of the database port.

Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.

Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.

Remote code execution in PostgreSQL logical decoding (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows any database user holding REPLICATION privilege - a role explicitly below superuser - to load arbitrary shared libraries via dlopen by specifying a malicious logical decoding plugin name, executing arbitrary code as the OS account running the server. This is a missing authorization flaw (CWE-862): the REPLICATION privilege was not intended to grant the ability to load native code. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact CVSS 7.2 vector and RCE outcome make this a high-priority patching target for any deployment that grants REPLICATION to non-superusers.

Denial of service against PostgreSQL DDL operations is achievable by any authenticated database user who creates a custom type, exploiting missing authorization checks in two specific code paths - range subtype assignment and SQL expression type references. By manufacturing an artificial type dependency through these unguarded paths, a low-privileged user can permanently block administrators from executing ALTER TYPE or DROP TYPE on the affected object, disrupting schema maintenance across PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5). No public exploit code exists and active exploitation has not been confirmed by CISA KEV at time of analysis.

Incorrect ownership reassignment in PostgreSQL's ALTER TABLE ALTER TYPE command allows a table owner to seize control of dependent statistics objects they did not create. Affected versions span all major supported branches prior to 18.5, 17.11, 16.15, 15.19, and 14.24. An authenticated table owner (high-privilege context per CVSS PR:H) can subsequently execute DROP STATISTICS or ALTER STATISTICS against statistics objects owned by another user, while simultaneously locking the legitimate statistics owner out of those same commands. No public exploit code exists and this CVE is not listed in CISA KEV.

Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.

Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.

Code injection in PostgreSQL's pg_dump, pg_dumpall, and pg_restore (plain-format mode) allows a malicious superuser of an origin database server to embed arbitrary OS-level commands into a dump file, which execute on the restoring client's operating system account when psql processes the dump. This is a confirmed bypass of the CVE-2025-8714 patch: the \unrestrict meta-command introduced by that fix is itself exploitable via psql meta-command input expansion, negating the protection that \restrict was intended to provide. No public exploit has been identified at time of analysis, but the high CVSS score (8.8) and full RCE impact make this urgent for any organization that accepts and restores PostgreSQL dumps from external or untrusted sources.

Buffer over-read in PostgreSQL's ascii() SQL function exposes up to 3 bytes of heap memory beyond a specific allocation boundary when processing a crafted text value. Authenticated database users on affected versions - PostgreSQL 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5 - can trigger this condition via a malicious SQL query. The vulnerability is a partial information disclosure with limited impact; no public exploit code has been identified at time of analysis.

Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.

Remote code execution in PostgreSQL's portal/cursor subsystem allows any authenticated database user to execute arbitrary code as the OS-level process owner (typically 'postgres') by re-creating a named cursor with an incompatible result type. All actively supported major branches are affected - versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and minimal authentication requirement (any valid login) make this a critical patch priority for the ubiquitous open-source RDBMS.

Remote code execution in PostgreSQL 18.x (all minor versions before 18.5) is achievable by any authenticated object creator through a type confusion flaw in pg_restore_attribute_stats(), which conflates range and multirange values to corrupt memory and gain code execution as the OS user running the database process. The CVSS 8.8 score reflects a low-privilege, low-complexity network exploit path with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis, but the RCE primitive combined with the low privilege bar makes this a high-priority patch target for all PostgreSQL 18 deployments.

Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.

SQL injection in PostgreSQL's EXTRACT() expression deparse enables a database object owner to escalate privileges and execute arbitrary SQL with superuser rights. Affected across the active PostgreSQL release tree - versions before 14.24, 15.19, 16.15, 17.11, and 18.5 - the flaw is triggered when deparse consumers such as pg_dump or psql's \sf command process a hostile object definition crafted by a low-privilege but authenticated database user. No public exploit code or CISA KEV listing exists at time of analysis; however, the superuser privilege-escalation impact and broad reach of affected deparse consumers make this a high-priority upgrade, particularly for multi-tenant or shared PostgreSQL environments.

PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.

Type confusion in PostgreSQL's 'internal' pseudo-type enforcement enables any authenticated database user to execute arbitrary code as the operating system user running the database process. The vulnerability arises because access controls blocking SQL-layer callers from invoking C-language functions that accept 'internal' arguments contained coverage gaps, allowing a crafted function call to corrupt memory and achieve OS-level code execution. Fixed versions are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24; no public exploit or CISA KEV listing has been identified at time of analysis.

Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.

Buffer over-read in PostgreSQL's pg_trgm extension exposes limited heap memory values to authenticated low-privileged users through the side-channel of GiST index picksplit decisions. All four active major release branches are affected - versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit has been identified and active exploitation has not been confirmed; the practical impact is constrained by the indirect, lossy nature of the information disclosure mechanism.

Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.

Untrusted search path in PostgreSQL's amcheck extension allows a database user holding EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes by injecting a hostile search_path before calling amcheck. Affected are PostgreSQL major versions 14, 15, 16, and 18 in releases prior to 14.24, 15.19, 16.15, and 18.5 respectively; version 17 is entirely unaffected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the niche exploitation prerequisite of an explicitly granted amcheck EXECUTE privilege.

User enumeration via SCRAM authentication in PostgreSQL 16-18 exposes whether a given username exists by observing differences in the reported SCRAM iteration count during the authentication handshake. An unauthenticated remote attacker can distinguish real accounts from nonexistent ones when the target account uses a non-default scram_iterations value, since the server returns a custom count for real users but the global default for fabricated usernames. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default server configuration.

Type confusion in PostgreSQL's 'refint' contrib module enables any low-privileged database user with object creation rights to execute arbitrary code as the operating system user hosting the PostgreSQL service. Affected are all active PostgreSQL branches prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. Notably, the fix was silently committed to the PostgreSQL git repository under the subject 'refint: Remove plan cache.' without a CVE assignment, meaning vulnerable installations may have remained unpatched far longer than typical because administrators had no security signal to act on. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.

PostgreSQL's ctid data type selectivity estimator mishandles non-ctid input through a type confusion flaw (CWE-843), enabling any low-privileged database user with object-creation rights to read approximately 4 bytes of arbitrary server memory per query. All supported major versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor explicitly acknowledges that substantial memory value recovery is possible.

Stale row-level security policy execution in PostgreSQL 14 through 18 permits authenticated database users to read or modify rows they are no longer authorized to access after role membership, role attributes, or database ownership are changed. The flaw lies in PostgreSQL's plan cache, which does not invalidate cached RLS policies when such privilege changes occur, meaning a revoked permission continues to be honored until the session ends or an unrelated cache invalidation event fires. No public exploit code has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, but the partial data access bypass represents a real confidentiality and integrity risk for applications relying on RLS as a security boundary.

Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.

Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.

Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.

SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission inject arbitrary PostgreSQL into the DDL of the system searchVector TS_VECTOR field. By supplying a crafted settings.asExpression via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, the attacker breaks out of the GENERATED ALWAYS AS (...) column clause and executes statements as the application database user, compromising all workspace data. It is fixed in 2.15.0, requires authenticated high-privilege access (CVSS 9.1, PR:H), and has no public exploit identified at time of analysis.

SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.

Command injection in Dokploy's database backup and restore utilities (prior to v0.29.13) lets an authenticated administrator execute arbitrary shell commands inside managed database containers by supplying crafted values in database name, username, or password configuration fields. All supported database types are affected - PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL - with subsequent-system impact rated High across confidentiality, integrity, and availability, reflecting that injected commands run inside the database containers rather than Dokploy itself. No confirmed active exploitation (not in CISA KEV), but the public fix PR includes functional injection payload examples that effectively demonstrate the technique, and the vendor has confirmed the issue via GitHub Security Advisory GHSA-qc73-mp78-4833.

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.

Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.

OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restore permission run arbitrary shell commands on the underlying Dokploy host. The backup.restoreBackupWithLogs tRPC subscription concatenates the user-supplied databaseName and backupFile fields directly into database restore and rclone shell pipelines, so crafted values break out of the intended command and execute via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fixing pull request (#4862) ships a regression test enumerating working injection payloads, and the CVSS of 9.9 with scope change reflects full host takeover from a low-privileged application role.

Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.

Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.

Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.

SQL injection in Directus before 12.1.0 enables an authenticated administrator to execute arbitrary SQL against the underlying PostgreSQL database during collection creation by embedding attacker-controlled SQL syntax within a geometry field type value. The attack is gated behind two non-default prerequisites - administrator-level credentials and a PostgreSQL backend with the PostGIS extension installed - which together constrain the realistic threat surface to insider risk or compromised admin accounts. A vendor patch is confirmed available in v12.1.0; no public exploit code or CISA KEV listing has been identified at time of analysis.

SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in `chirpstack/src/storage/device.rs` within both `get_count()` and `list()`, where the tag KEY is concatenated into raw SQL via Rust's `format!()` macro while only the tag VALUE receives safe parameterization through Diesel's `.bind()`. Only deployments using the `chirpstack-sqlite` package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.

SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.

OS command injection in pgAdmin 4 (all versions before 9.18) lets an authenticated user with the commonly-granted tools_import_export_data permission run arbitrary commands on the pgAdmin server host. The Import/Export Data tool renders a user-supplied query into a psql \copy (...) command line; its hand-written parenthesis-balance validator (_is_query_parens_balanced) wrongly assumes standard_conforming_strings=off, treating a backslash-quote (\') as an escaped quote, so a payload like SELECT 'a\') TO PROGRAM 'echo pwned' x' passes validation while real psql (scs=on, the default on PostgreSQL 13-18) closes the string early and executes an attacker-chosen TO PROGRAM clause via popen(). No CISA KEV listing and no standalone public exploit, but the fix commit's regression test discloses a fully working RCE payload; EPSS not provided.

SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the read-only transaction wrapper on the execute_sql_query tool and run arbitrary write or OS commands on the backend PostgreSQL server. The flaw is an incomplete fix for CVE-2026-12045: the sqlparse-based validator disagrees with PostgreSQL over backslash-before-quote string escaping, so a crafted SELECT parses as one statement to the guard but executes as four statements (including a smuggled COMMIT) on the database. Delivery is via indirect prompt injection, and detailed PoC payloads exist publicly in the vendor's regression tests; there is no public exploit identified as used in the wild and no KEV listing, with EPSS data not provided.

SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.

Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.

Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.

SQL injection via unescaped identifier interpolation in Kamaji's PostgreSQL and MySQL datastore drivers exposes the shared datastore root connection to arbitrary DDL/DML manipulation. Versions prior to 26.7.4-edge interpolate operator-supplied DataStoreUsername and DataStoreSchema fields directly into SQL via fmt.Sprintf without any identifier sanitization, allowing a quote or backtick character to break out of the identifier context. Compounding the risk, the pre-fix MySQL primary connection had multiStatements=true enabled, enabling stacked query execution over a root-privileged database connection that spans all hosted tenant control planes. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.

Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.

SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.

Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.

Unauthenticated webhook injection in APIFold corrupts trusted MCP server state by allowing any network client to POST arbitrary JSON payloads to the `/webhooks/:serverSlug/:eventName` endpoint, which are stored in Redis and the `webhook_events` PostgreSQL table without any signature check. All deployments prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 are affected; the flaw is architectural rather than misconfiguration-dependent, as signature validation was never wired into the webhook router. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the attack requires only a valid server slug, making exploitation straightforward for targeted actors.

Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.

Error-based SQL injection in the DHIS2 core SqlView API (the `filter` parameter of `/api/sqlViews/{viewId}/data.json`) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.

Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user reach server-side rendered admin content via the /remote_render endpoint, which renders arbitrary partials and helper-backed views without enforcing controller-specific authorization. On a test instance a Standard user retrieved the PostgreSQL admin dashboard statistics even though direct access to /admin redirected the user away, confirming an information-disclosure impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in 26.06.08.

Full-read server-side request forgery in CloudTAK (npm @tak-ps/cloudtak) v13.5.0 and earlier allows any authenticated user to coerce the API server into fetching attacker-supplied URLs - including the cloud instance metadata endpoint (169.254.169.254), loopback, RFC1918, and CGNAT ranges - with the full internal HTTP response body reflected verbatim in the API reply. The vulnerability exists in the `PUT /api/basemap` endpoint, where user-controlled URLs pass directly from URL parsing to `fetch()` with no IP-address classification and default redirect-following enabled. Three independent bypass classes (direct IP literals, decimal IP encoding, and 302-redirect chain exploitation) are confirmed end-to-end in the published advisory's proof-of-concept; no vendor-released patch is available at time of analysis, and no CISA KEV listing exists, but publicly available exploit code lowers the skill bar significantly.

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrary SQL against the backend PostgreSQL database via the /pa endpoint, which concatenates the attacker-supplied PhoneIP value from a <PolycomIPPhone> XML body into queries without parameterization. Because SQL access on this PostgreSQL deployment can be escalated to command execution, a single crafted, unauthenticated request yields full database compromise and remote code execution on the VoIP appliance. There is no public exploit identified at time of analysis, though vendor SRA published a technical writeup, and the CVSS 4.0 base score is 9.3 (Critical).

SQL injection in OpenRemote's datapoint crosstab export endpoint (all versions before 1.26.0) lets an authenticated user with asset creation or rename permissions exfiltrate database contents by embedding SQL into an asset display name that is concatenated into a raw PostgreSQL crosstab query. Injected SELECT results are streamed back inside the ZIP/CSV export response, giving a practical read primitive against any table the manager's database role can reach - including other tenants' data in multi-tenant deployments. Publicly available exploit code exists (VulnCheck/GHSA proof of concept); no active exploitation has been reported.

Cross-tenant step-file disclosure in Activepieces before 0.83.0 allows any authenticated user on a shared instance to retrieve a workflow step-file attachment belonging to a different tenant by exploiting two compounding defects in the `/v1/step-files/signed` download endpoint: a missing JWT audience check and an unguarded null fileId that causes PostgreSQL to return an arbitrary FLOW_STEP_FILE record. Access is strictly read-only and non-targeted - the attacker cannot choose which tenant's file is returned, as the result depends on PostgreSQL's internal scan order at query time. No public exploit has been identified and no active exploitation is listed in CISA KEV; the vulnerability is patched in version 0.83.0.

SQL injection in listmonk's subscriber export endpoint prior to version 6.2.0 allows a highly-privileged authenticated user to read arbitrary PostgreSQL database tables - including users and settings - and execute data-modifying CTEs. The GET /api/subscribers/export endpoint passed a user-controlled query parameter directly into QuerySubscribersForExport in internal/core/subscribers.go without invoking the validateQueryTables guard that the sibling GET /api/subscribers endpoint correctly applies, creating a bypass of the allowlist-based table restriction. Exploitation requires possession of both the subscribers:sql_query and subscribers:get_all permissions; no public exploit code has been identified at time of analysis.

Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user to execute arbitrary OS commands as the NocoBase server process by restoring a crafted backup archive. The database.schema field from a backup's _metadata.json is interpolated directly into a shell command string passed to Node.js child_process.exec(), a classic CWE-78 pattern that bypasses any sanitization at the shell level. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, but the commit diff confirms the mechanism is straightforward and the fix is available in v2.1.19.

SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticated user reach GET /api/myInAppChannels:list and inject into the filter[latestMsgReceiveTimestamp][$lt] parameter, which is concatenated into a Sequelize.literal() template with no escaping or parameter binding. Because PostgreSQL permits stacked statements through this sink, an attacker can run arbitrary SQL and escalate to operating-system command execution via COPY ... TO PROGRAM. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the code fix and regression tests are public in the vendor commit, and the vendor rates it CVSS 10.0.

PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.

SQL injection in DataEase before 2.10.23 lets an authenticated low-privilege user compromise the backend datasource by abusing the datasource connection-status check, where io.dataease.datasource.provider.CalciteProvider#checkStatus concatenates the user-controlled configuration.getSchema() value into getTablesSql and runs it via executeQuery. Because the schema/owner string is embedded directly into metadata queries for DB2, SQL Server, PostgreSQL, Oracle and other datasources, an attacker who can create or edit a datasource can inject arbitrary SQL and read or alter data on the connected database. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor commit that replaces string concatenation with parameterized PreparedStatements.

Blind SQL injection in decidim-admin's organization user search endpoint allows authenticated organization administrators to execute arbitrary PostgreSQL expressions inside an ORDER BY clause via the `term` query parameter. The flaw spans decidim-admin versions prior to 0.30.9, 0.31.5, and 0.32.0, and is exploitable using time-based payloads such as `pg_sleep` that return HTTP 200 while leaking data through measurable response-time deltas. No public exploit tool is identified at time of analysis and the vulnerability is not in CISA KEV, but the advisory provides working reproduction steps with a concrete payload, confirming practical exploitability.

Unauthenticated API key metadata disclosure in Capgo before 12.128.2 stems from the find_apikey_by_value PostgreSQL function being marked SECURITY DEFINER and granted to the anon role, allowing anyone to call it through the PostgREST endpoint /rest/v1/rpc/find_apikey_by_value. When supplied a valid key value, an attacker retrieves sensitive metadata about that key - user_id, mode, organization scoping, and expiration details - bypassing normal row-level security. Reported by VulnCheck with CVSS 4.0 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.

SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated administrator to inject arbitrary SQL via the du, ds, and dip query parameters of the delete-user, delete-secret, and delete-IP operations, yielding full backend database control and, on PostgreSQL deployments, OS-level command execution through COPY TO PROGRAM. The admin panel's parameters are interpolated into queries with snprintf while bypassing the is_secure_string filter that guards the STUN protocol path. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV; fixed in Coturn 4.12.0.

SQL injection in Postgrex.Notifications' reconnect replay path allows an attacker who can supply untrusted input as a PostgreSQL LISTEN channel name to corrupt the shared notification connection, silently dropping all channel subscriptions and causing persistent denial of service of the notification subsystem. Affected versions are postgrex 0.16.0 through 0.22.2 in the Elixir ecosystem. No arbitrary SQL execution is possible due to double-quote escaping, and no public exploit or CISA KEV listing exists; the CVSS 4.0 base score of 2.1 reflects the constrained, precondition-heavy impact.

Connection string injection in KEDA's PostgreSQL scaler allows low-privileged tenants to inject arbitrary libpq connection parameters by embedding tab, newline, or other non-space whitespace characters into ScaledObject or TriggerAuthentication configuration fields. The `escapePostgreConnectionParameter` function in `pkg/scalers/postgresql_scaler.go` only detects literal spaces before quoting values, leaving all other libpq token delimiters unescaped; successful exploitation forces TLS downgrade (sslmode=disable) or redirects database connections to attacker-controlled hosts to steal operator-supplied credentials. A working proof-of-concept YAML payload is included in GitHub advisory GHSA-6w3m-4hhp-775q; no CISA KEV listing was present at time of analysis.

Path traversal leading to remote code execution in Coolify (self-hosted PaaS) before 4.0.0-beta.474 allows an authenticated user to abuse insufficient filename sanitization in the PostgreSQL initialization-script generator (generate_init_scripts() in app/Actions/Database/StartPostgresql.php) to write files outside the intended directory and execute commands during database init. Any user with sufficient privileges to provision a PostgreSQL resource can escalate to code execution on the Coolify host. No public exploit identified at time of analysis, though the fix commit and security advisory publicly disclose the vulnerable code path.

Command injection in Coolify self-hosted PaaS versions prior to 4.0.0-beta.474 allows an authenticated user to run arbitrary OS commands inside the PostgreSQL database container by supplying malicious postgres_user or postgres_db values that are interpolated into shell-form healthcheck commands (CWE-78). Because the CVSS vector is PR:L/UI:N with full high impact to confidentiality, integrity, and availability, any user able to create or configure a database can achieve container-level code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Server-side file disclosure in Langroid's SQLChatAgent (Python, pip package `langroid` <= 0.65.0) lets an attacker who can influence the agent's LLM-generated SQL bypass the `_validate_query` safety guard and execute PostgreSQL file-read functions such as `pg_read_file`. The default `allow_dangerous_operations=False` blocklist relies on a raw-text regex requiring `pg_...` names to be immediately followed by `(`, which is evaded by quoted identifiers, inline comments, or schema qualification while still parsing as a permitted SELECT. This is a bypass of the earlier CVE-2026-25879 / GHSA-pmch-g965-grmr regex fix; a working reproduction harness is published in the GHSA advisory, though there is no public exploit identified as being used in active attacks and no CISA KEV listing.

Channel-binding downgrade in the pgjdbc PostgreSQL JDBC Driver (releases 42.7.4 through 42.7.11) lets an active man-in-the-middle silently strip SCRAM-SHA-256-PLUS channel binding down to plain SCRAM-SHA-256 even when the client explicitly set channelBinding=require, defeating the exact protection that setting promises. The flaw stems from the bundled com.ongres.scram:scram-client returning an empty binding for certificates whose signature algorithm lacks a tls-server-end-point hash, combined with pgJDBC's ScramAuthenticator failing to reject that empty binding. No public exploit identified at time of analysis and it is not listed in CISA KEV; it is fixed in 42.7.12.

Server-side script source disclosure in Algernon web server on Windows allows unauthenticated remote attackers to retrieve verbatim script source by appending NTFS filename-equivalent suffixes (::$DATA, trailing dot, trailing space) to any public-path script URL. Algernon versions 1.17.8 and earlier are affected when deployed on Windows/NTFS; Linux and macOS are entirely unaffected. A detailed proof-of-concept is included in the GitHub Security Advisory GHSA-mm6c-5j6x-hq8m, and successful exploitation leaks embedded database credentials and SetCookieSecret values - enabling secondary authentication bypass through session cookie forgery.

Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfiltrate files from the PostgreSQL host even under the strict default config (allow_dangerous_operations=False, allowed_statement_types=['SELECT']). The _validate_query blocklist enumerates dangerous functions by exact name and misses the pg_read_file/pg_stat_file/pg_ls_*/pg_current_logfile family (plus MSSQL OPENDATASOURCE and keyword-less SQLite ATTACH), so these SELECT-shaped payloads pass both the statement-type allowlist and the regex blocklist and reach the live SQLAlchemy engine. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); no public exploit identified as actively exploited and this is not in CISA KEV.

PostgreSQL Anonymizer's anon.hash() function exposes its internal salt to masked database users through an offline brute-force attack, undermining the core pseudonymization guarantee of the extension. Masked roles - the primary consumer of this extension - can call anon.hash() with arbitrary seed inputs and accumulate (seed, hash_output) pairs to deduce the salt offline, after which all pseudonymized values in the database become reversible. No active exploitation or public proof-of-concept has been identified; a vendor-confirmed fix is available in version 3.1.2.