PostgreSQL
Monthly
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
An unbounded-memory denial of service in the Eclipse Vert.x PostgreSQL client (io.vertx:vertx-pg-client) allows a malicious, compromised, or man-in-the-middle PostgreSQL server to crash a client application by sending a wire-protocol message header whose 4-byte length field is set to an extremely large value (up to Integer.MAX_VALUE). The client-side decoder performs no maximum-size validation, so it keeps accumulating TCP data into a composite buffer until the JVM exhausts heap and terminates; the abuse happens during connection startup, before authentication completes, so no valid database credentials are required - the attacker only needs to control the server side of the connection or sit on the client-to-PostgreSQL TCP path. Per the independent assessment this is a genuine but conditional availability risk (CVSS 8.2, AV:N/AC:H, availability-only impact) rather than a mass-exploitation priority: no public exploit code or confirmed active exploitation was identified at time of analysis, and clients that connect exclusively to trusted, authenticated, TLS-verified PostgreSQL servers are not realistically exposed.
Denial of service in Eclipse Vert.x's vertx-pg-client component allows an attacker controlling the PostgreSQL server or positioned as a man-in-the-middle on an unencrypted connection to crash the client application. The flaw resides in the binary array decoder (DataTypeCodec.binaryDecodeArray), which allocates a Java array based on a server-supplied 32-bit dimension count without upper bound checking, leading to a multi-gigabyte heap allocation and OutOfMemoryError. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. Exploitation requires no authentication (PR:N) but does require control of the database server or a MITM position on a non-TLS connection (AC:H), and no public exploit code has been identified at time of analysis.
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.
Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.
Denial of service in MobilityDB 1.3.0 and earlier allows an authenticated PostgreSQL database user with the MobilityDB extension installed to crash the backend process - and thereby terminate all sessions on that instance - by supplying a crafted Well-Known Binary (WKB) payload with a negative length field. Exploitation requires only a valid low-privileged database login (CVSS AV:N/PR:L) and the ability to invoke a binary input path such as ttextFromBinary, ttextFromHexWKB, COPY ... BINARY, or binary-protocol parameters; no public exploit code has been identified at time of analysis. Vendor patches are available in MobilityDB v1.3.1 and v1.2.2.
Missing authorization in WarehousePG (WHPG) 7.x before 7.6.0-WHPG lets any authenticated database role - with no superuser rights, no GRANT, and no special role membership - call the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink and pg_logdir_ls, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived _v1_1 implementations during the merge onto a PostgreSQL 12 base. An attacker holding ordinary database credentials can therefore create, append to, overwrite, rename and delete files under the data and log directories and enumerate log file names, and by appending directives such as shared_preload_libraries or archive_command to postgresql.auto.conf can achieve arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected because its equivalent functions enforce an internal superuser check, and no public exploit code has been identified at time of analysis (no CISA KEV entry).
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
Vertical privilege escalation and account takeover in Capgo (capgo.app) through 12.261.0: an authenticated attacker who already holds the org_admin tier permission org.update_settings can rewrite the provider_id column of a public.sso_providers row over PostgREST and point the organization's email-domain trust anchor at an identity provider they control, after which the server-side SSO merge routine binds the attacker's identity to the legitimate org owner account, nulls that account's password, and deletes its other identities and sessions. The impact is full owner/super_admin takeover plus lockout of the real owner, although exploitation is gated on the target organization having an active SSO provider configured and on the attacker already possessing org_admin in that organization; no public exploit code was identified at time of analysis and there is no CISA KEV entry. The incomplete nature of the fix (a BEFORE UPDATE guard that freezes dns_verified_at, domain, status and enforce_sso but leaves provider_id, metadata_url and attribute_mapping writable under a table-wide ALL grant with only row-scoped RLS) makes this a durable privilege-escalation path rather than a one-off misconfiguration.
Heap out-of-bounds reads in pgPointcloud through 1.2.5 allow an authenticated PostgreSQL user who can supply or store pcpatch values to copy bytes from adjacent backend heap memory into a persisted patch, enabling information disclosure or a backend crash (CVSS 4.0 base 7.2, CWE-125). The defect lives in dimensional patch WKB deserialization, where an attacker-controlled dimension size field is trusted without being validated against the remaining buffer length; exploitation requires a valid database session, the pgPointcloud extension installed, and the ability to insert or construct pointcloud-typed values. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and an upstream fix is available via pull request 388.
Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.
Unauthenticated network clients can retrieve the complete runtime configuration of an OpenObserve instance - including plaintext PostgreSQL connection strings (meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn) and usage_reporting_creds - simply by issuing a GET request to /config/runtime, which is registered without any authentication check. The flaw affects all OpenObserve releases prior to 0.90.3 and stems from a hide_sensitive_fields keyword filter that does not recognize the field names dsn or creds, so those values are serialized verbatim; deployments using a PostgreSQL metadata backend are most severely impacted because live database credentials are exposed, while all deployments leak the root administrator email, internal NATS address, and filesystem layout. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) confirms remote, unauthenticated, no-interaction exploitation against default configurations; no public exploit code or active exploitation was identified at time of analysis. Vendor-released patch: 0.90.3.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Missing authorization checks on Warpgate's recording-stream WebSocket let any authenticated user with an ordinary account watch live terminal input and output from other people's proxied sessions. Specifically, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs guards /@warpgate/admin/api/recordings/{uuid}/stream with session authentication only and never calls require_admin_permission for AdminPermission::RecordingsView, so an attacker who can identify an active recording's UUID receives, in real time, the keystrokes and output of proxied SSH, MySQL, and PostgreSQL sessions - including credentials and commands belonging to regular users and administrators. Warpgate versions prior to 0.25.6 are affected and the flaw is fixed in 0.25.6 (CVSS 3.1 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attack is authenticated and timing-dependent because the recording must be actively streaming, and no public exploit code was identified at time of analysis.
SQL injection in pg_partman before 5.5.0 allows an authenticated low-privileged partman_user to escalate to PostgreSQL superuser and execute operating-system commands as the PostgreSQL service account. The flaw only fires when pg_jobmon is installed, part_config.jobmon is true for the target partition set, and an affected exception handler in a pg_partman function actually runs; the injected SQL then executes with the privileges of pg_partman_bgw.role, which defaulted to a PostgreSQL superuser prior to 5.5.0. The malicious parent-table name is stored persistently in part_config, so the escalation can re-trigger on later background-worker maintenance ticks; exploitation is conditional and most dangerous in multi-tenant clusters that use jobmon with a superuser background worker, and no public exploit code was identified at time of analysis. Fixed in 5.5.0.
SQL injection in pg_partman before 5.5.0 allows an authenticated partman_user who owns a template table to escape the generated ALTER TABLE ADD PRIMARY KEY statement by placing a double-quote character in a column name, causing the background worker to run attacker-supplied SQL under the worker's role. Because pre-5.5.0 deployments effectively default pg_partman_bgw.role to a PostgreSQL superuser, successful exploitation yields database-wide compromise and operating-system command execution as the PostgreSQL service account, with the crafted catalog identifier persisting and re-triggering during later child-partition creation. Exploitation is gated on the background worker actually applying the primary key to a child partition (hence AC:H) and is neutralized entirely if the worker runs as a non-superuser role; no public exploit identified at time of analysis, and the flaw is fixed in 5.5.0 (CVSS 3.1 score 8.5).
SQL injection in pg_partman prior to 5.5.0 allows an authenticated PostgreSQL role holding the documented partman_user privileges to plant arbitrary SQL in the writable part_config.time_dncoder column and have it executed when routine maintenance or partition-inspection functions later interpolate that value into dynamic SQL. Because the injected statement runs with the privileges of the invoking operation, deployments whose pg_partman_bgw.role GUC is still pointed at a superuser role (the historical default before 5.5.0) can be escalated to database-wide compromise and operating-system command execution as the PostgreSQL service account, and the poisoned configuration row can re-establish elevated access on subsequent background-worker ticks. Exploitation requires write access to part_config and is most realistic in multi-tenant instances where several roles share pg_partman, and no public exploit code was identified at time of analysis; version 5.5.0 fixes the issue. The assessed CVSS is 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting authenticated access and a high-complexity, scope-changing path rather than a remotely unauthenticated attack.
SQL injection in pg_partman prior to 5.5.0 lets a role with partman_user access store arbitrary SQL - rather than a legitimate function name - in the part_config.time_encoder column, which undo_partition() interpolates into a dynamically executed SELECT without identifier quoting and runs with the privileges of whichever caller invokes that function. Exploitation is a two-step confused-deputy chain: an authenticated writer plants the payload, and a separate more-privileged role must later call undo_partition() on the same partition set, which is why the assessed vector is AV:N/AC:H/PR:L with impact bounded by the invoking caller rather than the attacker, and it does not carry the automatic superuser escalation of the background-worker create-partition flaw. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved in pg_partman 5.5.0.
Unauthorized relocation of retained partition child tables in pg_partman before 5.5.0 lets an authenticated database role holding partman_user access move another tenant's child tables into a schema it does not own. The cause is that drop_partition_id() and drop_partition_time() pass part_config.retention_schema straight into ALTER TABLE SET SCHEMA, and the background worker executes the move under pg_partman_bgw.role - a PostgreSQL superuser by default before this release - so the privilege check that normally guards SET SCHEMA is never enforced. The realistic impact is bounded to multi-tenant deployments where several roles own partition sets on the same instance, no public exploit code was identified at time of analysis, and the escalation is fully neutralized by pointing pg_partman_bgw.role at a non-superuser role, which the vendor confirms can be done even before upgrading.
SQL injection in the pg_partman PostgreSQL extension before version 5.5.0 lets an authenticated database role that holds the documented partman_user INSERT/UPDATE privileges on the part_config table store SQL text in the writable time_encoder column instead of a legitimate function name. When the pg_partman_bgw background worker next creates a child partition for a text- or UUID-keyed set, that stored SQL is interpolated into a dynamically executed SELECT and runs with the privileges of pg_partman_bgw.role, which the pre-5.5.0 documentation defaults to a superuser such as 'postgres'; because the payload persists in the configuration row, elevated access can be re-established on subsequent maintenance ticks and can lead to database-wide compromise and operating-system command execution as the PostgreSQL service account. The issue is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is fixed in 5.5.0; no public exploit identified at time of analysis, and exploitation requires an attacker to already possess partman_user grants plus a deployment where the background worker runs as a superuser.
ArcadeDB deployments through 26.8.1 allow any authenticated principal - including a low-privileged user explicitly denied readRecord and deleteRecord on a given type - to bypass per-type/per-record access-control rules and read indexed key values, record IDs, MIN/MAX values, record counts and TimeSeries samples, and to delete index entries via ordinary SQL statements such as SELECT key, rid FROM INDEX:Type[field] and DELETE FROM INDEX:Type[field]. The flaw exists because ACL checks are enforced only in LocalBucket (keyed on file id) and are never invoked by query paths that reach record data through LSM index files or the TimeSeries engine, while schema discovery via SELECT FROM schema:indexes is unfiltered and exposes the index and type names needed to build an exploit. It affects both embedded and server deployments across all transports (HTTP, Bolt, Postgres, Gremlin), is exploitable with a single ordinary SQL statement and no user interaction, carries a CVSS 4.0 base score of 7.1, and has no public exploit identified at time of analysis; upgrading to 26.9.1 removes the flaw.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate privileges over the network, potentially achieving full control over database resources. With a critical CVSS score of 9.9 due to scope change and high impact, the flaw requires a valid low-privileged identity to exploit; no public exploit code has been identified at time of analysis.
Authenticated SQL injection in SQLBot before 1.9.0 allows a user with a valid account to achieve operating-system command execution inside the SQLBot container. The attacker submits a crafted sheet["tableName"] value to POST /api/v1/datasource/, SQLBot stores it unsanitized, and the value is later interpolated into datasource cleanup SQL executed by PostgreSQL when that datasource is deleted via DELETE /api/v1/datasource/{id}; a second-order injection that can reach PostgreSQL COPY TO PROGRAM and run arbitrary commands with the privileges of the postgres process. Exploitation is gated by valid credentials, a two-request state dependency (raising attack complexity, AC:H/AT:P), and the postgres role's ability to invoke COPY TO PROGRAM; there is no public exploit identified at time of analysis, and only deployments running releases prior to 1.9.0 are affected.
Unauthenticated SQL injection in MapServer 8.4.0 through 8.6.3 lets remote attackers who can reach a PostGIS-backed query endpoint inject arbitrary SQL fragments into the generated PostgreSQL predicate, bypassing record-level filters and enumerating data they should not see. The flaw is reachable via the CGI qstring filter or an OGC API Features featureId path segment when a layer is configured with CONNECTIONTYPE POSTGIS and numeric item metadata such as gml_<item>_type=Integer; the unquoted value is concatenated straight into the SQL statement. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L vector, confidentiality impact is high while integrity is unaffected, meaning successful exploitation yields predicate bypass, unintended-record enumeration, and blind boolean- or time-based extraction rather than database modification, with a modest availability cost from increased database load; no public exploit code and no confirmed active exploitation were identified at time of analysis, and version 8.6.4 fixes the issue.
Unauthenticated denial of service in Vendure (open-source headless commerce platform) versions up to and including 3.6.4 lets a remote attacker freeze the Node.js event loop by supplying a catastrophically backtracking regular expression to the publicly reachable Shop GraphQL products query through StringOperators.regex, rendering both the storefront and admin API unavailable; repeated requests can sustain the outage. The flaw is only reachable on instances running the better-sqlite3 or sqljs SQLite drivers, which register a synchronous JavaScript REGEXP user-defined function on the event loop, whereas PostgreSQL and MySQL/MariaDB deployments push the pattern to the database engine and are unaffected. CVSS 3.1 rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis; vendor-released patch: 3.6.5.
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.0.0 through 9.12.x and lets an authenticated attacker who can influence strings reaching Marten's LINQ or tenant-management paths break out of single-quoted SQL/JSON-path literals and inject an always-true predicate, causing filter or multi-tenant authorization bypass and blind data exfiltration; on deployments that permit semicolon-batched Npgsql statements, data modification is also possible. The primary confirmed vector is a dictionary indexer key used in Where filters (src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs); Dictionary.ContainsKey is exploitable only under the Newtonsoft serializer, tenant identifiers reaching DeleteAllForTenant.cs via IEventStore.DeleteProjectionProgressAsync are likewise affected, and EventLoader.cs contains a related defense-in-depth sink. The vendor confirmed the issue in GHSA-rfx3-98h7-v3xp and fixed it in version 9.13.0 via PR #4911; no public exploit code was identified at time of analysis, and exploitation requires the host application to route attacker-controlled strings into one of these Marten paths.
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
Out-of-bounds read in PostGIS address_standardizer through 3.7.0 allows authenticated database users to crash the entire PostgreSQL cluster by supplying rule rows with out-of-range Weight values. The Weight field is consumed directly as an array index into the load_value array inside rules_add_rule() (src/gamma.c:338) without any bounds validation, so a Weight of -1 or >= NUMBER_OF_WEIGHTS triggers an OOB read that terminates the PostgreSQL backend process and drops all active cluster sessions. No public exploit code has been identified at time of analysis; patch commits are available upstream.
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on the host of a self-managed PostgreSQL server, even in the server's default read-only mode. The read-only enforcement in the SQL validation component fails to reject PostgreSQL's COPY ... TO PROGRAM construct, so a crafted statement embedded in content processed when an authenticated user interacts with the MCP server executes shell commands on the database host. No public exploit identified at time of analysis; the flaw is fixed in 1.1.7 and documented in AWS bulletin 2026-104 and GHSA-fph8-pg5w-78fv.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
Incomplete SQL validation denylist in Amazon awslabs postgres-mcp-server before 1.1.7 allows an unauthenticated attacker to bypass read-only enforcement and perform write operations against a PostgreSQL database by embedding crafted SQL in content processed when an authenticated user interacts with the MCP server. The vulnerability (CWE-184) exploits the incomplete list of disallowed SQL constructs, effectively turning user-triggered MCP interactions into a vector for unauthorized data modification with high integrity impact (VI:H) and no confidentiality or availability effect. No public exploit code has been identified at time of analysis; a vendor-released patch is available at version 1.1.7.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Arbitrary file read in Postgres MCP Pro 0.3.0 (crystaldba/postgres-mcp) lets attackers bypass restricted-mode SQL safeguards by invoking file-reading functions such as pg_read_file inside FROM-clause RangeFunction nodes, which the function-name allowlist fails to inspect. Any client able to submit queries to the MCP server can therefore read files accessible to the PostgreSQL service account despite the tool's safety controls. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; the technique is described in a VulnCheck advisory and GitHub issue #178.
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database content to any authenticated user by injecting arbitrary PostgreSQL expressions into ORDER BY clauses via the sort-field query parameter in pagination helper functions. This is explicitly an incomplete remediation of the prior CVE-2026-25947, indicating the original fix was insufficient and the root-cause injection sink remains open. No confirmed active exploitation is present in CISA KEV, but a public GitHub security advisory (GHSA-f2f8-2ppj-85pf) provides sufficient technical disclosure to guide reproduction.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
SQL injection in WAPT Server's GET /api/v3/hosts REST API endpoint allows any remote authenticated user with read-only privileges to inject arbitrary PostgreSQL expressions via the `columns` query parameter, bypassing host-scope access controls and exfiltrating data from tables beyond the user's authorized scope. Versions 2.6.1.17834 and earlier are confirmed affected per CPE cpe:2.3:a:tranquil_it:wapt. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a realistic internal threat for any WAPT deployment; a vendor patch is available.
Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. When PostgreSQL rejects the ALTER SCHEMA rename due to a name collision, the library silently reports success, causing the tenant metadata row to be committed pointing at the victim's live schema - routing all subsequent reads and writes for the attacker's tenant against the victim's data. No public exploit code or CISA KEV listing has been identified at time of analysis.
JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. Exploitation enables overwriting the system zone's JWT signing key, forging tokens claiming admin and administrator scopes, and cascading into full UAA and Cloud Foundry compromise; no public exploit has been identified at time of analysis, though the Changed-Scope CVSS vector and PR:H signal a high-severity, low-noise attack path against MySQL-backed deployments.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
SQL injection and chained code injection in baserCMS before 5.3.0 allow authenticated administrators to exfiltrate arbitrary data from a PostgreSQL backend via BcDatabaseService.php. The attack chains two flaws: a backup restore mechanism that unconditionally executes PHP code outside class definitions in schema files upon loading, enabling an admin to plant malicious table names, which are then passed unsanitized into SQL statements across sequence update, CSV export, and table management operations. Error-based SQL injection against the PostgreSQL backend can then retrieve database version, schema contents, and sensitive application data. No public exploit has been identified and this CVE is not in CISA KEV, but the VulnCheck advisory provides sufficient technical detail to guide exploitation by motivated actors.
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings without defensive identifier quoting. Operators using the Postgres backend in affected versions are directly impacted; the CVSS 4.0 vector (PR:H, AT:P) reflects that the current vulnerable code path requires operator-level control over schema configuration, though the unsafe pattern creates latent risk if schema names are ever derived from tenant or request input. No public exploit code exists and no CISA KEV listing has been identified; the vendor-released patch in 0.9.0a2 resolves the issue by adding identifier quoting and regression coverage.
SQL injection in Budibase's PostgreSQL datasource connector allows an authenticated administrator to execute arbitrary DDL and DML statements against the connected PostgreSQL database by supplying a crafted schema name containing embedded double quotes. The vulnerable code in packages/server/src/integrations/postgres.ts interpolates the schema field directly into a SET search_path statement using the simple query protocol, which permits semicolon-delimited multi-statement execution. Impact includes full database read and write access - including extraction of pg_shadow password hashes and potential OS-level file reads via pg_read_file(). No public exploit or CISA KEV listing identified at time of analysis; however, the GHSA advisory provides a complete, step-by-step reproduction procedure making this trivially reproducible. Fixed in version 3.39.19.
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.
Hardcoded PostgreSQL credentials embedded in openssl_encrypt standalone server configuration files expose backend databases to unauthorized access in all versions before 1.4.0. Network-adjacent attackers who obtain the well-known static credentials - trivially available from the distributed software package or public advisory - can authenticate directly to the PostgreSQL instance and retrieve sensitive stored data without any legitimate account. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the CWE-798 root cause makes exploitation mechanically trivial for any attacker within network reach of the database port.
Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.
Remote code execution in PostgreSQL logical decoding (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows any database user holding REPLICATION privilege - a role explicitly below superuser - to load arbitrary shared libraries via dlopen by specifying a malicious logical decoding plugin name, executing arbitrary code as the OS account running the server. This is a missing authorization flaw (CWE-862): the REPLICATION privilege was not intended to grant the ability to load native code. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact CVSS 7.2 vector and RCE outcome make this a high-priority patching target for any deployment that grants REPLICATION to non-superusers.
Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Code injection in PostgreSQL's pg_dump, pg_dumpall, and pg_restore (plain-format mode) allows a malicious superuser of an origin database server to embed arbitrary OS-level commands into a dump file, which execute on the restoring client's operating system account when psql processes the dump. This is a confirmed bypass of the CVE-2025-8714 patch: the \unrestrict meta-command introduced by that fix is itself exploitable via psql meta-command input expansion, negating the protection that \restrict was intended to provide. No public exploit has been identified at time of analysis, but the high CVSS score (8.8) and full RCE impact make this urgent for any organization that accepts and restores PostgreSQL dumps from external or untrusted sources.
Remote code execution in PostgreSQL's portal/cursor subsystem allows any authenticated database user to execute arbitrary code as the OS-level process owner (typically 'postgres') by re-creating a named cursor with an incompatible result type. All actively supported major branches are affected - versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and minimal authentication requirement (any valid login) make this a critical patch priority for the ubiquitous open-source RDBMS.
Remote code execution in PostgreSQL 18.x (all minor versions before 18.5) is achievable by any authenticated object creator through a type confusion flaw in pg_restore_attribute_stats(), which conflates range and multirange values to corrupt memory and gain code execution as the OS user running the database process. The CVSS 8.8 score reflects a low-privilege, low-complexity network exploit path with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis, but the RCE primitive combined with the low privilege bar makes this a high-priority patch target for all PostgreSQL 18 deployments.
Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.
SQL injection in PostgreSQL's EXTRACT() expression deparse enables a database object owner to escalate privileges and execute arbitrary SQL with superuser rights. Affected across the active PostgreSQL release tree - versions before 14.24, 15.19, 16.15, 17.11, and 18.5 - the flaw is triggered when deparse consumers such as pg_dump or psql's \sf command process a hostile object definition crafted by a low-privilege but authenticated database user. No public exploit code or CISA KEV listing exists at time of analysis; however, the superuser privilege-escalation impact and broad reach of affected deparse consumers make this a high-priority upgrade, particularly for multi-tenant or shared PostgreSQL environments.
Type confusion in PostgreSQL's 'internal' pseudo-type enforcement enables any authenticated database user to execute arbitrary code as the operating system user running the database process. The vulnerability arises because access controls blocking SQL-layer callers from invoking C-language functions that accept 'internal' arguments contained coverage gaps, allowing a crafted function call to corrupt memory and achieve OS-level code execution. Fixed versions are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.
Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Type confusion in PostgreSQL's 'refint' contrib module enables any low-privileged database user with object creation rights to execute arbitrary code as the operating system user hosting the PostgreSQL service. Affected are all active PostgreSQL branches prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. Notably, the fix was silently committed to the PostgreSQL git repository under the subject 'refint: Remove plan cache.' without a CVE assignment, meaning vulnerable installations may have remained unpatched far longer than typical because administrators had no security signal to act on. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.
PostgreSQL's ctid data type selectivity estimator mishandles non-ctid input through a type confusion flaw (CWE-843), enabling any low-privileged database user with object-creation rights to read approximately 4 bytes of arbitrary server memory per query. All supported major versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor explicitly acknowledges that substantial memory value recovery is possible.
Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.
Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.
SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission inject arbitrary PostgreSQL into the DDL of the system searchVector TS_VECTOR field. By supplying a crafted settings.asExpression via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, the attacker breaks out of the GENERATED ALWAYS AS (...) column clause and executes statements as the application database user, compromising all workspace data. It is fixed in 2.15.0, requires authenticated high-privilege access (CVSS 9.1, PR:H), and has no public exploit identified at time of analysis.
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.
OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restore permission run arbitrary shell commands on the underlying Dokploy host. The backup.restoreBackupWithLogs tRPC subscription concatenates the user-supplied databaseName and backupFile fields directly into database restore and rclone shell pipelines, so crafted values break out of the intended command and execute via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fixing pull request (#4862) ships a regression test enumerating working injection payloads, and the CVSS of 9.9 with scope change reflects full host takeover from a low-privileged application role.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
SQL injection in Directus before 12.1.0 enables an authenticated administrator to execute arbitrary SQL against the underlying PostgreSQL database during collection creation by embedding attacker-controlled SQL syntax within a geometry field type value. The attack is gated behind two non-default prerequisites - administrator-level credentials and a PostgreSQL backend with the PostGIS extension installed - which together constrain the realistic threat surface to insider risk or compromised admin accounts. A vendor patch is confirmed available in v12.1.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in pgAdmin 4 (all versions before 9.18) lets an authenticated user with the commonly-granted tools_import_export_data permission run arbitrary commands on the pgAdmin server host. The Import/Export Data tool renders a user-supplied query into a psql \copy (...) command line; its hand-written parenthesis-balance validator (_is_query_parens_balanced) wrongly assumes standard_conforming_strings=off, treating a backslash-quote (\') as an escaped quote, so a payload like SELECT 'a\') TO PROGRAM 'echo pwned' x' passes validation while real psql (scs=on, the default on PostgreSQL 13-18) closes the string early and executes an attacker-chosen TO PROGRAM clause via popen(). No CISA KEV listing and no standalone public exploit, but the fix commit's regression test discloses a fully working RCE payload; EPSS not provided.
SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the read-only transaction wrapper on the execute_sql_query tool and run arbitrary write or OS commands on the backend PostgreSQL server. The flaw is an incomplete fix for CVE-2026-12045: the sqlparse-based validator disagrees with PostgreSQL over backslash-before-quote string escaping, so a crafted SELECT parses as one statement to the guard but executes as four statements (including a smuggled COMMIT) on the database. Delivery is via indirect prompt injection, and detailed PoC payloads exist publicly in the vendor's regression tests; there is no public exploit identified as used in the wild and no KEV listing, with EPSS data not provided.
SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
Error-based SQL injection in the DHIS2 core SqlView API (the `filter` parameter of `/api/sqlViews/{viewId}/data.json`) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
An unbounded-memory denial of service in the Eclipse Vert.x PostgreSQL client (io.vertx:vertx-pg-client) allows a malicious, compromised, or man-in-the-middle PostgreSQL server to crash a client application by sending a wire-protocol message header whose 4-byte length field is set to an extremely large value (up to Integer.MAX_VALUE). The client-side decoder performs no maximum-size validation, so it keeps accumulating TCP data into a composite buffer until the JVM exhausts heap and terminates; the abuse happens during connection startup, before authentication completes, so no valid database credentials are required - the attacker only needs to control the server side of the connection or sit on the client-to-PostgreSQL TCP path. Per the independent assessment this is a genuine but conditional availability risk (CVSS 8.2, AV:N/AC:H, availability-only impact) rather than a mass-exploitation priority: no public exploit code or confirmed active exploitation was identified at time of analysis, and clients that connect exclusively to trusted, authenticated, TLS-verified PostgreSQL servers are not realistically exposed.
Denial of service in Eclipse Vert.x's vertx-pg-client component allows an attacker controlling the PostgreSQL server or positioned as a man-in-the-middle on an unencrypted connection to crash the client application. The flaw resides in the binary array decoder (DataTypeCodec.binaryDecodeArray), which allocates a Java array based on a server-supplied 32-bit dimension count without upper bound checking, leading to a multi-gigabyte heap allocation and OutOfMemoryError. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0. Exploitation requires no authentication (PR:N) but does require control of the database server or a MITM position on a non-TLS connection (AC:H), and no public exploit code has been identified at time of analysis.
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.
Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.
Denial of service in MobilityDB 1.3.0 and earlier allows an authenticated PostgreSQL database user with the MobilityDB extension installed to crash the backend process - and thereby terminate all sessions on that instance - by supplying a crafted Well-Known Binary (WKB) payload with a negative length field. Exploitation requires only a valid low-privileged database login (CVSS AV:N/PR:L) and the ability to invoke a binary input path such as ttextFromBinary, ttextFromHexWKB, COPY ... BINARY, or binary-protocol parameters; no public exploit code has been identified at time of analysis. Vendor patches are available in MobilityDB v1.3.1 and v1.2.2.
Missing authorization in WarehousePG (WHPG) 7.x before 7.6.0-WHPG lets any authenticated database role - with no superuser rights, no GRANT, and no special role membership - call the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink and pg_logdir_ls, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived _v1_1 implementations during the merge onto a PostgreSQL 12 base. An attacker holding ordinary database credentials can therefore create, append to, overwrite, rename and delete files under the data and log directories and enumerate log file names, and by appending directives such as shared_preload_libraries or archive_command to postgresql.auto.conf can achieve arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected because its equivalent functions enforce an internal superuser check, and no public exploit code has been identified at time of analysis (no CISA KEV entry).
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
Vertical privilege escalation and account takeover in Capgo (capgo.app) through 12.261.0: an authenticated attacker who already holds the org_admin tier permission org.update_settings can rewrite the provider_id column of a public.sso_providers row over PostgREST and point the organization's email-domain trust anchor at an identity provider they control, after which the server-side SSO merge routine binds the attacker's identity to the legitimate org owner account, nulls that account's password, and deletes its other identities and sessions. The impact is full owner/super_admin takeover plus lockout of the real owner, although exploitation is gated on the target organization having an active SSO provider configured and on the attacker already possessing org_admin in that organization; no public exploit code was identified at time of analysis and there is no CISA KEV entry. The incomplete nature of the fix (a BEFORE UPDATE guard that freezes dns_verified_at, domain, status and enforce_sso but leaves provider_id, metadata_url and attribute_mapping writable under a table-wide ALL grant with only row-scoped RLS) makes this a durable privilege-escalation path rather than a one-off misconfiguration.
Heap out-of-bounds reads in pgPointcloud through 1.2.5 allow an authenticated PostgreSQL user who can supply or store pcpatch values to copy bytes from adjacent backend heap memory into a persisted patch, enabling information disclosure or a backend crash (CVSS 4.0 base 7.2, CWE-125). The defect lives in dimensional patch WKB deserialization, where an attacker-controlled dimension size field is trusted without being validated against the remaining buffer length; exploitation requires a valid database session, the pgPointcloud extension installed, and the ability to insert or construct pointcloud-typed values. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and an upstream fix is available via pull request 388.
Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.
Unauthenticated network clients can retrieve the complete runtime configuration of an OpenObserve instance - including plaintext PostgreSQL connection strings (meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn) and usage_reporting_creds - simply by issuing a GET request to /config/runtime, which is registered without any authentication check. The flaw affects all OpenObserve releases prior to 0.90.3 and stems from a hide_sensitive_fields keyword filter that does not recognize the field names dsn or creds, so those values are serialized verbatim; deployments using a PostgreSQL metadata backend are most severely impacted because live database credentials are exposed, while all deployments leak the root administrator email, internal NATS address, and filesystem layout. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) confirms remote, unauthenticated, no-interaction exploitation against default configurations; no public exploit code or active exploitation was identified at time of analysis. Vendor-released patch: 0.90.3.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Missing authorization checks on Warpgate's recording-stream WebSocket let any authenticated user with an ordinary account watch live terminal input and output from other people's proxied sessions. Specifically, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs guards /@warpgate/admin/api/recordings/{uuid}/stream with session authentication only and never calls require_admin_permission for AdminPermission::RecordingsView, so an attacker who can identify an active recording's UUID receives, in real time, the keystrokes and output of proxied SSH, MySQL, and PostgreSQL sessions - including credentials and commands belonging to regular users and administrators. Warpgate versions prior to 0.25.6 are affected and the flaw is fixed in 0.25.6 (CVSS 3.1 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attack is authenticated and timing-dependent because the recording must be actively streaming, and no public exploit code was identified at time of analysis.
SQL injection in pg_partman before 5.5.0 allows an authenticated low-privileged partman_user to escalate to PostgreSQL superuser and execute operating-system commands as the PostgreSQL service account. The flaw only fires when pg_jobmon is installed, part_config.jobmon is true for the target partition set, and an affected exception handler in a pg_partman function actually runs; the injected SQL then executes with the privileges of pg_partman_bgw.role, which defaulted to a PostgreSQL superuser prior to 5.5.0. The malicious parent-table name is stored persistently in part_config, so the escalation can re-trigger on later background-worker maintenance ticks; exploitation is conditional and most dangerous in multi-tenant clusters that use jobmon with a superuser background worker, and no public exploit code was identified at time of analysis. Fixed in 5.5.0.
SQL injection in pg_partman before 5.5.0 allows an authenticated partman_user who owns a template table to escape the generated ALTER TABLE ADD PRIMARY KEY statement by placing a double-quote character in a column name, causing the background worker to run attacker-supplied SQL under the worker's role. Because pre-5.5.0 deployments effectively default pg_partman_bgw.role to a PostgreSQL superuser, successful exploitation yields database-wide compromise and operating-system command execution as the PostgreSQL service account, with the crafted catalog identifier persisting and re-triggering during later child-partition creation. Exploitation is gated on the background worker actually applying the primary key to a child partition (hence AC:H) and is neutralized entirely if the worker runs as a non-superuser role; no public exploit identified at time of analysis, and the flaw is fixed in 5.5.0 (CVSS 3.1 score 8.5).
SQL injection in pg_partman prior to 5.5.0 allows an authenticated PostgreSQL role holding the documented partman_user privileges to plant arbitrary SQL in the writable part_config.time_dncoder column and have it executed when routine maintenance or partition-inspection functions later interpolate that value into dynamic SQL. Because the injected statement runs with the privileges of the invoking operation, deployments whose pg_partman_bgw.role GUC is still pointed at a superuser role (the historical default before 5.5.0) can be escalated to database-wide compromise and operating-system command execution as the PostgreSQL service account, and the poisoned configuration row can re-establish elevated access on subsequent background-worker ticks. Exploitation requires write access to part_config and is most realistic in multi-tenant instances where several roles share pg_partman, and no public exploit code was identified at time of analysis; version 5.5.0 fixes the issue. The assessed CVSS is 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting authenticated access and a high-complexity, scope-changing path rather than a remotely unauthenticated attack.
SQL injection in pg_partman prior to 5.5.0 lets a role with partman_user access store arbitrary SQL - rather than a legitimate function name - in the part_config.time_encoder column, which undo_partition() interpolates into a dynamically executed SELECT without identifier quoting and runs with the privileges of whichever caller invokes that function. Exploitation is a two-step confused-deputy chain: an authenticated writer plants the payload, and a separate more-privileged role must later call undo_partition() on the same partition set, which is why the assessed vector is AV:N/AC:H/PR:L with impact bounded by the invoking caller rather than the attacker, and it does not carry the automatic superuser escalation of the background-worker create-partition flaw. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is resolved in pg_partman 5.5.0.
Unauthorized relocation of retained partition child tables in pg_partman before 5.5.0 lets an authenticated database role holding partman_user access move another tenant's child tables into a schema it does not own. The cause is that drop_partition_id() and drop_partition_time() pass part_config.retention_schema straight into ALTER TABLE SET SCHEMA, and the background worker executes the move under pg_partman_bgw.role - a PostgreSQL superuser by default before this release - so the privilege check that normally guards SET SCHEMA is never enforced. The realistic impact is bounded to multi-tenant deployments where several roles own partition sets on the same instance, no public exploit code was identified at time of analysis, and the escalation is fully neutralized by pointing pg_partman_bgw.role at a non-superuser role, which the vendor confirms can be done even before upgrading.
SQL injection in the pg_partman PostgreSQL extension before version 5.5.0 lets an authenticated database role that holds the documented partman_user INSERT/UPDATE privileges on the part_config table store SQL text in the writable time_encoder column instead of a legitimate function name. When the pg_partman_bgw background worker next creates a child partition for a text- or UUID-keyed set, that stored SQL is interpolated into a dynamically executed SELECT and runs with the privileges of pg_partman_bgw.role, which the pre-5.5.0 documentation defaults to a superuser such as 'postgres'; because the payload persists in the configuration row, elevated access can be re-established on subsequent maintenance ticks and can lead to database-wide compromise and operating-system command execution as the PostgreSQL service account. The issue is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is fixed in 5.5.0; no public exploit identified at time of analysis, and exploitation requires an attacker to already possess partman_user grants plus a deployment where the background worker runs as a superuser.
ArcadeDB deployments through 26.8.1 allow any authenticated principal - including a low-privileged user explicitly denied readRecord and deleteRecord on a given type - to bypass per-type/per-record access-control rules and read indexed key values, record IDs, MIN/MAX values, record counts and TimeSeries samples, and to delete index entries via ordinary SQL statements such as SELECT key, rid FROM INDEX:Type[field] and DELETE FROM INDEX:Type[field]. The flaw exists because ACL checks are enforced only in LocalBucket (keyed on file id) and are never invoked by query paths that reach record data through LSM index files or the TimeSeries engine, while schema discovery via SELECT FROM schema:indexes is unfiltered and exposes the index and type names needed to build an exploit. It affects both embedded and server deployments across all transports (HTTP, Bolt, Postgres, Gremlin), is exploitable with a single ordinary SQL statement and no user interaction, carries a CVSS 4.0 base score of 7.1, and has no public exploit identified at time of analysis; upgrading to 26.9.1 removes the flaw.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate privileges over the network, potentially achieving full control over database resources. With a critical CVSS score of 9.9 due to scope change and high impact, the flaw requires a valid low-privileged identity to exploit; no public exploit code has been identified at time of analysis.
Authenticated SQL injection in SQLBot before 1.9.0 allows a user with a valid account to achieve operating-system command execution inside the SQLBot container. The attacker submits a crafted sheet["tableName"] value to POST /api/v1/datasource/, SQLBot stores it unsanitized, and the value is later interpolated into datasource cleanup SQL executed by PostgreSQL when that datasource is deleted via DELETE /api/v1/datasource/{id}; a second-order injection that can reach PostgreSQL COPY TO PROGRAM and run arbitrary commands with the privileges of the postgres process. Exploitation is gated by valid credentials, a two-request state dependency (raising attack complexity, AC:H/AT:P), and the postgres role's ability to invoke COPY TO PROGRAM; there is no public exploit identified at time of analysis, and only deployments running releases prior to 1.9.0 are affected.
Unauthenticated SQL injection in MapServer 8.4.0 through 8.6.3 lets remote attackers who can reach a PostGIS-backed query endpoint inject arbitrary SQL fragments into the generated PostgreSQL predicate, bypassing record-level filters and enumerating data they should not see. The flaw is reachable via the CGI qstring filter or an OGC API Features featureId path segment when a layer is configured with CONNECTIONTYPE POSTGIS and numeric item metadata such as gml_<item>_type=Integer; the unquoted value is concatenated straight into the SQL statement. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L vector, confidentiality impact is high while integrity is unaffected, meaning successful exploitation yields predicate bypass, unintended-record enumeration, and blind boolean- or time-based extraction rather than database modification, with a modest availability cost from increased database load; no public exploit code and no confirmed active exploitation were identified at time of analysis, and version 8.6.4 fixes the issue.
Unauthenticated denial of service in Vendure (open-source headless commerce platform) versions up to and including 3.6.4 lets a remote attacker freeze the Node.js event loop by supplying a catastrophically backtracking regular expression to the publicly reachable Shop GraphQL products query through StringOperators.regex, rendering both the storefront and admin API unavailable; repeated requests can sustain the outage. The flaw is only reachable on instances running the better-sqlite3 or sqljs SQLite drivers, which register a synchronous JavaScript REGEXP user-defined function on the event loop, whereas PostgreSQL and MySQL/MariaDB deployments push the pattern to the database engine and are unaffected. CVSS 3.1 rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis; vendor-released patch: 3.6.5.
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.0.0 through 9.12.x and lets an authenticated attacker who can influence strings reaching Marten's LINQ or tenant-management paths break out of single-quoted SQL/JSON-path literals and inject an always-true predicate, causing filter or multi-tenant authorization bypass and blind data exfiltration; on deployments that permit semicolon-batched Npgsql statements, data modification is also possible. The primary confirmed vector is a dictionary indexer key used in Where filters (src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs); Dictionary.ContainsKey is exploitable only under the Newtonsoft serializer, tenant identifiers reaching DeleteAllForTenant.cs via IEventStore.DeleteProjectionProgressAsync are likewise affected, and EventLoader.cs contains a related defense-in-depth sink. The vendor confirmed the issue in GHSA-rfx3-98h7-v3xp and fixed it in version 9.13.0 via PR #4911; no public exploit code was identified at time of analysis, and exploitation requires the host application to route attacker-controlled strings into one of these Marten paths.
Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
Out-of-bounds read in PostGIS address_standardizer through 3.7.0 allows authenticated database users to crash the entire PostgreSQL cluster by supplying rule rows with out-of-range Weight values. The Weight field is consumed directly as an array index into the load_value array inside rules_add_rule() (src/gamma.c:338) without any bounds validation, so a Weight of -1 or >= NUMBER_OF_WEIGHTS triggers an OOB read that terminates the PostgreSQL backend process and drops all active cluster sessions. No public exploit code has been identified at time of analysis; patch commits are available upstream.
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on the host of a self-managed PostgreSQL server, even in the server's default read-only mode. The read-only enforcement in the SQL validation component fails to reject PostgreSQL's COPY ... TO PROGRAM construct, so a crafted statement embedded in content processed when an authenticated user interacts with the MCP server executes shell commands on the database host. No public exploit identified at time of analysis; the flaw is fixed in 1.1.7 and documented in AWS bulletin 2026-104 and GHSA-fph8-pg5w-78fv.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
Incomplete SQL validation denylist in Amazon awslabs postgres-mcp-server before 1.1.7 allows an unauthenticated attacker to bypass read-only enforcement and perform write operations against a PostgreSQL database by embedding crafted SQL in content processed when an authenticated user interacts with the MCP server. The vulnerability (CWE-184) exploits the incomplete list of disallowed SQL constructs, effectively turning user-triggered MCP interactions into a vector for unauthorized data modification with high integrity impact (VI:H) and no confidentiality or availability effect. No public exploit code has been identified at time of analysis; a vendor-released patch is available at version 1.1.7.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Arbitrary file read in Postgres MCP Pro 0.3.0 (crystaldba/postgres-mcp) lets attackers bypass restricted-mode SQL safeguards by invoking file-reading functions such as pg_read_file inside FROM-clause RangeFunction nodes, which the function-name allowlist fails to inspect. Any client able to submit queries to the MCP server can therefore read files accessible to the PostgreSQL service account despite the tool's safety controls. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; the technique is described in a VulnCheck advisory and GitHub issue #178.
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database content to any authenticated user by injecting arbitrary PostgreSQL expressions into ORDER BY clauses via the sort-field query parameter in pagination helper functions. This is explicitly an incomplete remediation of the prior CVE-2026-25947, indicating the original fix was insufficient and the root-cause injection sink remains open. No confirmed active exploitation is present in CISA KEV, but a public GitHub security advisory (GHSA-f2f8-2ppj-85pf) provides sufficient technical disclosure to guide reproduction.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
SQL injection in WAPT Server's GET /api/v3/hosts REST API endpoint allows any remote authenticated user with read-only privileges to inject arbitrary PostgreSQL expressions via the `columns` query parameter, bypassing host-scope access controls and exfiltrating data from tables beyond the user's authorized scope. Versions 2.6.1.17834 and earlier are confirmed affected per CPE cpe:2.3:a:tranquil_it:wapt. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a realistic internal threat for any WAPT deployment; a vendor patch is available.
Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. When PostgreSQL rejects the ALTER SCHEMA rename due to a name collision, the library silently reports success, causing the tenant metadata row to be committed pointing at the victim's live schema - routing all subsequent reads and writes for the attacker's tenant against the victim's data. No public exploit code or CISA KEV listing has been identified at time of analysis.
JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. Exploitation enables overwriting the system zone's JWT signing key, forging tokens claiming admin and administrator scopes, and cascading into full UAA and Cloud Foundry compromise; no public exploit has been identified at time of analysis, though the Changed-Scope CVSS vector and PR:H signal a high-severity, low-noise attack path against MySQL-backed deployments.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
SQL injection and chained code injection in baserCMS before 5.3.0 allow authenticated administrators to exfiltrate arbitrary data from a PostgreSQL backend via BcDatabaseService.php. The attack chains two flaws: a backup restore mechanism that unconditionally executes PHP code outside class definitions in schema files upon loading, enabling an admin to plant malicious table names, which are then passed unsanitized into SQL statements across sequence update, CSV export, and table management operations. Error-based SQL injection against the PostgreSQL backend can then retrieve database version, schema contents, and sensitive application data. No public exploit has been identified and this CVE is not in CISA KEV, but the VulnCheck advisory provides sufficient technical detail to guide exploitation by motivated actors.
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings without defensive identifier quoting. Operators using the Postgres backend in affected versions are directly impacted; the CVSS 4.0 vector (PR:H, AT:P) reflects that the current vulnerable code path requires operator-level control over schema configuration, though the unsafe pattern creates latent risk if schema names are ever derived from tenant or request input. No public exploit code exists and no CISA KEV listing has been identified; the vendor-released patch in 0.9.0a2 resolves the issue by adding identifier quoting and regression coverage.
SQL injection in Budibase's PostgreSQL datasource connector allows an authenticated administrator to execute arbitrary DDL and DML statements against the connected PostgreSQL database by supplying a crafted schema name containing embedded double quotes. The vulnerable code in packages/server/src/integrations/postgres.ts interpolates the schema field directly into a SET search_path statement using the simple query protocol, which permits semicolon-delimited multi-statement execution. Impact includes full database read and write access - including extraction of pg_shadow password hashes and potential OS-level file reads via pg_read_file(). No public exploit or CISA KEV listing identified at time of analysis; however, the GHSA advisory provides a complete, step-by-step reproduction procedure making this trivially reproducible. Fixed in version 3.39.19.
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privileged tenant escalate to arbitrary code execution inside the cluster's PostgreSQL pod. An authenticated hub administrator or Search Custom Resource editor can supply an unsanitized WORK_MEM value that is passed into both a bash script and an SQL query, breaking out of the intended data plane. No public exploit is identified at time of analysis and the flaw is not on CISA KEV, but the CVSS 9.1 rating reflects full confidentiality, integrity, and availability loss with a scope change.
Hardcoded PostgreSQL credentials embedded in openssl_encrypt standalone server configuration files expose backend databases to unauthorized access in all versions before 1.4.0. Network-adjacent attackers who obtain the well-known static credentials - trivially available from the distributed software package or public advisory - can authenticate directly to the PostgreSQL instance and retrieve sensitive stored data without any legitimate account. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the CWE-798 root cause makes exploitation mechanically trivial for any attacker within network reach of the database port.
Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.
Remote code execution in PostgreSQL logical decoding (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows any database user holding REPLICATION privilege - a role explicitly below superuser - to load arbitrary shared libraries via dlopen by specifying a malicious logical decoding plugin name, executing arbitrary code as the OS account running the server. This is a missing authorization flaw (CWE-862): the REPLICATION privilege was not intended to grant the ability to load native code. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact CVSS 7.2 vector and RCE outcome make this a high-priority patching target for any deployment that grants REPLICATION to non-superusers.
Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. No public exploit code has been identified at time of analysis, but the CVSS 8.1 score reflects the potential for full confidentiality, integrity, and availability impact when the dual-control preconditions are met.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Code injection in PostgreSQL's pg_dump, pg_dumpall, and pg_restore (plain-format mode) allows a malicious superuser of an origin database server to embed arbitrary OS-level commands into a dump file, which execute on the restoring client's operating system account when psql processes the dump. This is a confirmed bypass of the CVE-2025-8714 patch: the \unrestrict meta-command introduced by that fix is itself exploitable via psql meta-command input expansion, negating the protection that \restrict was intended to provide. No public exploit has been identified at time of analysis, but the high CVSS score (8.8) and full RCE impact make this urgent for any organization that accepts and restores PostgreSQL dumps from external or untrusted sources.
Remote code execution in PostgreSQL's portal/cursor subsystem allows any authenticated database user to execute arbitrary code as the OS-level process owner (typically 'postgres') by re-creating a named cursor with an incompatible result type. All actively supported major branches are affected - versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and minimal authentication requirement (any valid login) make this a critical patch priority for the ubiquitous open-source RDBMS.
Remote code execution in PostgreSQL 18.x (all minor versions before 18.5) is achievable by any authenticated object creator through a type confusion flaw in pg_restore_attribute_stats(), which conflates range and multirange values to corrupt memory and gain code execution as the OS user running the database process. The CVSS 8.8 score reflects a low-privilege, low-complexity network exploit path with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis, but the RCE primitive combined with the low privilege bar makes this a high-priority patch target for all PostgreSQL 18 deployments.
Remote code execution via integer wraparound in PostgreSQL's fuzzystrmatch contrib module allows any authenticated database user to corrupt memory and execute arbitrary code as the operating system account running the database server. All maintained PostgreSQL branches are affected: versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE impact, low attack complexity, and network accessibility establish this as a high-priority patching target.
SQL injection in PostgreSQL's EXTRACT() expression deparse enables a database object owner to escalate privileges and execute arbitrary SQL with superuser rights. Affected across the active PostgreSQL release tree - versions before 14.24, 15.19, 16.15, 17.11, and 18.5 - the flaw is triggered when deparse consumers such as pg_dump or psql's \sf command process a hostile object definition crafted by a low-privilege but authenticated database user. No public exploit code or CISA KEV listing exists at time of analysis; however, the superuser privilege-escalation impact and broad reach of affected deparse consumers make this a high-priority upgrade, particularly for multi-tenant or shared PostgreSQL environments.
Type confusion in PostgreSQL's 'internal' pseudo-type enforcement enables any authenticated database user to execute arbitrary code as the operating system user running the database process. The vulnerability arises because access controls blocking SQL-layer callers from invoking C-language functions that accept 'internal' arguments contained coverage gaps, allowing a crafted function call to corrupt memory and achieve OS-level code execution. Fixed versions are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.
Integer wraparound in 32-bit builds of PostgreSQL's PL/Tcl and PL/Perl procedural language extensions enables an authenticated object creator to provoke an undersized heap allocation and perform an out-of-bounds write via a crafted function body, ultimately achieving arbitrary code execution as the OS user running the database process. PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24 across active major release branches are affected. This is a recurrence of the class of integer arithmetic flaws previously addressed by CVE-2026-6473, indicating an incomplete prior remediation; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Type confusion in PostgreSQL's 'refint' contrib module enables any low-privileged database user with object creation rights to execute arbitrary code as the operating system user hosting the PostgreSQL service. Affected are all active PostgreSQL branches prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. Notably, the fix was silently committed to the PostgreSQL git repository under the subject 'refint: Remove plan cache.' without a CVE assignment, meaning vulnerable installations may have remained unpatched far longer than typical because administrators had no security signal to act on. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.
PostgreSQL's ctid data type selectivity estimator mishandles non-ctid input through a type confusion flaw (CWE-843), enabling any low-privileged database user with object-creation rights to read approximately 4 bytes of arbitrary server memory per query. All supported major versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor explicitly acknowledges that substantial memory value recovery is possible.
Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.
Integer wraparound in PostgreSQL's tsvector and tsquery full-text search functions allows an unprivileged database user to trigger an undersized heap allocation and subsequently write out-of-bounds, with potential for arbitrary code execution as the operating system user running the database process. All supported major release lines are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - and the vulnerability closely mirrors CVE-2026-6473, which addressed a similar integer overflow class in the same subsystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating with full High C/I/A impact reflects the worst-case consequence of successful exploitation.
SQL injection in Twenty, an open-source CRM platform, lets a workspace administrator holding the DATA_MODEL permission inject arbitrary PostgreSQL into the DDL of the system searchVector TS_VECTOR field. By supplying a crafted settings.asExpression via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, the attacker breaks out of the GENERATED ALWAYS AS (...) column clause and executes statements as the application database user, compromising all workspace data. It is fixed in 2.15.0, requires authenticated high-privilege access (CVSS 9.1, PR:H), and has no public exploit identified at time of analysis.
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.
OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restore permission run arbitrary shell commands on the underlying Dokploy host. The backup.restoreBackupWithLogs tRPC subscription concatenates the user-supplied databaseName and backupFile fields directly into database restore and rclone shell pipelines, so crafted values break out of the intended command and execute via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fixing pull request (#4862) ships a regression test enumerating working injection payloads, and the CVSS of 9.9 with scope change reflects full host takeover from a low-privileged application role.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
SQL injection in Directus before 12.1.0 enables an authenticated administrator to execute arbitrary SQL against the underlying PostgreSQL database during collection creation by embedding attacker-controlled SQL syntax within a geometry field type value. The attack is gated behind two non-default prerequisites - administrator-level credentials and a PostgreSQL backend with the PostGIS extension installed - which together constrain the realistic threat surface to insider risk or compromised admin accounts. A vendor patch is confirmed available in v12.1.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in pgAdmin 4 (all versions before 9.18) lets an authenticated user with the commonly-granted tools_import_export_data permission run arbitrary commands on the pgAdmin server host. The Import/Export Data tool renders a user-supplied query into a psql \copy (...) command line; its hand-written parenthesis-balance validator (_is_query_parens_balanced) wrongly assumes standard_conforming_strings=off, treating a backslash-quote (\') as an escaped quote, so a payload like SELECT 'a\') TO PROGRAM 'echo pwned' x' passes validation while real psql (scs=on, the default on PostgreSQL 13-18) closes the string early and executes an attacker-chosen TO PROGRAM clause via popen(). No CISA KEV listing and no standalone public exploit, but the fix commit's regression test discloses a fully working RCE payload; EPSS not provided.
SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the read-only transaction wrapper on the execute_sql_query tool and run arbitrary write or OS commands on the backend PostgreSQL server. The flaw is an incomplete fix for CVE-2026-12045: the sqlparse-based validator disagrees with PostgreSQL over backslash-before-quote string escaping, so a crafted SELECT parses as one statement to the guard but executes as four statements (including a smuggled COMMIT) on the database. Delivery is via indirect prompt injection, and detailed PoC payloads exist publicly in the vendor's regression tests; there is no public exploit identified as used in the wild and no KEV listing, with EPSS data not provided.
SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
Error-based SQL injection in the DHIS2 core SqlView API (the `filter` parameter of `/api/sqlViews/{viewId}/data.json`) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.