PostgreSQL
Monthly
SQL injection in PostgreSQL StatementGenerator allows authenticated attackers to execute arbitrary SQL commands through unsanitized object keys in sort, select, and groupBy parameters on analytics endpoints. The vulnerability exists because column name validation was incompletely applied during a previous fix, leaving three query construction methods vulnerable to direct identifier injection. An attacker with valid credentials can exploit this to access or manipulate database contents without requiring user interaction.
Kysely through version 0.28.11 contains a SQL injection vulnerability in JSON path compilation affecting MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() methods directly into single-quoted JSON path string literals without escaping single quotes, enabling attackers to break out of the string context and inject arbitrary SQL. A working proof-of-concept demonstrates UNION-based data exfiltration from SQLite databases. The vulnerability has CVSS score 8.2 and patches are available from the vendor.
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands against connected PostgreSQL, MySQL, and MSSQL databases through the built-in SQL Agent plugin. The vulnerability stems from unsafe string concatenation of table names in the getTableSchemaSql() method across all three database connectors, bypassing proper parameterization. Any user with access to invoke the SQL Agent can exploit this to read, modify, or delete sensitive database contents.
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.
Parse Server versions prior to 9.6.0-alpha.6 and 8.6.32 allow attackers to bypass class-level permission restrictions on protected fields by using dot-notation in query and sort parameters, enabling enumeration of sensitive field values through binary oracle attacks. This affects both MongoDB and PostgreSQL deployments and requires no authentication or user interaction. No patch is currently available for affected versions.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
Command injection in Budibase 3.23.22 and earlier allows authenticated attackers with high privileges to execute arbitrary system commands by injecting malicious values into PostgreSQL connection parameters that are unsanitized in shell command construction. An attacker with administrative access can exploit this vulnerability to gain complete control over the underlying server hosting the Budibase instance. No patch is currently available for this vulnerability.
SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database contents. CVSS 9.9 with scope change. PoC available.
Arbitrary code execution in TimescaleDB 2.23.0 through 2.25.1 allows local authenticated users to execute malicious functions by shadowing built-in PostgreSQL functions through user-writable schemas in the search_path setting during extension upgrades. An attacker with database access can create malicious functions in writable schemas that are invoked instead of legitimate PostgreSQL functions, resulting in code execution with database privileges. No patch is currently available for affected installations.
SQL injection in Chartbrew before 4.8.3. PoC available.
Denial of service in Traefik versions prior to 3.6.8 allows unauthenticated remote attackers to exhaust connection resources by exploiting improper timeout handling in STARTTLS request processing. An attacker can send a PostgreSQL SSLRequest prelude and then stall the connection indefinitely, bypassing the readTimeout protection and accumulating open connections until service availability is degraded. A patch is available in version 3.6.8.
Heap buffer overflow in the pg_trgm extension of PostgreSQL 18.0 and 18.1 allows authenticated database users to trigger memory corruption through specially crafted input strings. An attacker with database access could potentially achieve privilege escalation or cause service disruption, though exploit complexity is currently limited by restricted control over written data. No patch is currently available.
Arbitrary code execution in PostgreSQL results from insufficient validation of multibyte character lengths in text manipulation functions, allowing authenticated database users to trigger buffer overflows and execute commands with database process privileges. Affected versions include PostgreSQL 14.x before 14.21, 15.x before 15.16, 16.x before 16.12, 17.x before 17.8, and all versions before 18.2. No patch is currently available, leaving databases vulnerable to privilege escalation attacks from database-level users.
Arbitrary code execution in PostgreSQL pgcrypto module (versions before 14.21, 15.16, 16.12, 17.8, and 18.2) stems from a heap buffer overflow that allows attackers with database access to execute commands with the privileges of the PostgreSQL system user. An authenticated attacker can exploit this vulnerability by providing specially crafted ciphertext to trigger the overflow condition. No patch is currently available, leaving affected PostgreSQL installations vulnerable to privilege escalation and full system compromise.
PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21 contain insufficient input validation in the intarray extension's selectivity estimator function, enabling authenticated users with object creation privileges to execute arbitrary code with database server privileges. The vulnerability requires valid database credentials but allows complete system compromise through code execution at the OS level. No patch is currently available for affected deployments.
OpenMetadata versions prior to 1.11.8 expose JWT tokens for the privileged ingestion-bot account through the /api/v1/ingestionPipelines API endpoint, allowing any read-only user to escalate privileges and impersonate a highly privileged service account. With public exploit code available and no patch currently deployed on most instances, attackers can perform destructive actions within OpenMetadata and access sensitive metadata that should be restricted by role-based policies. This vulnerability affects OpenMetadata deployments and related systems like PostgreSQL that depend on its authentication tokens.
Privilege escalation in PostgreSQL Anonymizer allows authenticated users with CREATE privileges to gain superuser access by exploiting unsafe function execution within temporary views. This vulnerability affects PostgreSQL 15 and later, with heightened risk on PostgreSQL 14 instances due to default public schema permissions, and impacts all users unable to upgrade to version 3.0.1 or later. No patch is currently available for affected deployments.
PostgreSQL Anonymizer allows authenticated users to escalate to superuser privileges by injecting malicious code into custom operators placed in the public schema, which execute with elevated privileges during extension creation. This vulnerability primarily affects PostgreSQL 14 and instances upgraded from earlier versions, as PostgreSQL 15+ restricts public schema creation permissions by default. A patch is available in PostgreSQL Anonymizer version 3.0.1 and later.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 67.3% and no vendor patch available.
PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperly neutralize quoting syntax, enabling SQL injection when function results are used to construct psql input. This vulnerability was used as the initial access vector in the BeyondTrust RS compromise chain.
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated SQL injection in PeerBanHelper versions 5.0.0 through releases before 9.3.15 enables a high-privileged web API user to read arbitrary data from the configured SQLite, MySQL, or PostgreSQL database by supplying an unrecognized field value to the /api/statistic/analysis/field endpoint. Exploitation requires valid admin-panel credentials (CVSS PR:H) and reachable API access, with no user interaction needed. CVE-2026-62362 is rated medium severity (CVSS 4.9), is fixed in 9.3.15, and has no public exploit identified at time of analysis.
Rate-limit bypass in Better Auth (better-auth and @better-auth/drizzle-adapter 1.6.17 through 1.7.6, plus @better-auth/kysely-adapter 1.6.17 up to but not including 1.7.0) lets remote unauthenticated attackers defeat throttling on password sign-in, two-factor verification, one-time-code and password-reset endpoints by firing bursts of concurrent requests that all pass the limit check before any counter update lands. It is rated moderate (CVSS 4.0 6.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because success depends on achieving genuine request concurrency inside a narrow check-then-update window, and the realized impact is defeat of throttling that can enable credential or one-time-code guessing rather than direct data or system compromise. No CISA KEV listing and no public exploit identified at time of analysis; the bypass only applies where the deployment uses Better Auth database-backed rate limiting with a PostgreSQL store and has rate limiting enabled on the targeted endpoints.
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
Read-only mode bypass in Tabularis through 0.27.0 lets prompt-injected AI agents or untrusted MCP clients execute data-modifying SQL that the run_query safety gate misclassifies as read-only, allowing side-effecting statements such as setval, nextval, or PostgreSQL query_to_xml with an embedded DELETE to alter or destroy data without triggering an approval prompt. The issue is a local, MCP-channel authorization flaw (assessed CVSS:3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:H/A:H; CVSS 4.0 base 5.8) that only matters when read-only mode is relied upon as a security control against a backend exposing such functions, and the provided CVSS vector indicates no privileges are required (PR:N) while the operator still must interact with the agent (UI:P). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so risk is driven by preconditions-an exposed MCP run_query connection to PostgreSQL-rather than by active exploitation.
Heap memory corruption in Apache DataSketches C++ (datasketches-cpp) versions 4.1.0 through 5.2.0 allows remote attackers to trigger out-of-bounds reads and writes via a crafted Count-Min sketch submitted to the deserialize() function. The flaw combines a missing preamble size check that permits up to 16 bytes over-read on truncated input, and a 32-bit integer overflow in the serialized bucket count that can wrap to zero, resulting in an empty table and subsequent heap memory corruption during updates or estimate queries. Exploitation requires an application to deserialize Count-Min sketches from untrusted sources; no public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the severity as moderate.
Cleartext database credential disclosure via man-in-the-middle interception affects pgjdbc (PostgreSQL JDBC Driver) versions 42.7.11 through 42.7.13 when the caller-supplied requireAuth connection property is set to exclude all six authentication methods the driver recognizes (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or to a value containing no method at all (requireAuth=, a single comma). In that state the driver fails open and accepts whatever method the server requests, including cleartext password authentication, so an attacker who already holds an active man-in-the-middle position between the application and the PostgreSQL server can request cleartext authentication and capture the database password. Exposure is narrow: requireAuth has no default value, so deployments that never set the property are unaffected, and positive lists (requireAuth=scram-sha-256) or partial exclusions (requireAuth=!password,!md5) are enforced correctly; no public exploit identified at time of analysis and the issue is not in CISA KEV. Scoring is confidentiality-only at CVSS 5.9 with high attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting that both a specific client misconfiguration and a pre-existing network foothold are required.
Residual-data disclosure in the PostgreSQL JDBC Driver (pgjdbc) 42.7.4 through 42.7.13 allows an authenticated attacker who can influence how an application writes a value to recover SQL text and parameter values belonging to earlier statements on the same connection. When an application declares a value length larger than the bytes it actually supplies through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes, the driver pads the shortfall with whatever bytes remain in its send buffer instead of zeros, exposing up to 8192 bytes of recent traffic per value (16320 bytes when GSS encryption is in use); on a pooled connection those bytes may belong to other tenants or requests. Exploitation is conditional rather than trivial: the affected application must both store and read back such a padded value, its declared lengths must not always match its data, and any cross-request leakage depends on connection pooling, which is why the vendor rates this 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV).
Values written through the PostgreSQL JDBC Driver (pgjdbc) 42.7.4 and 42.7.5 over a GSS/Kerberos-encrypted connection can be silently stored by the server with bytes from the driver's previous GSS send buffer spliced into the front of them, so the persisted value holds earlier SQL text, other bind parameters, or earlier rows of the same batch instead of what the application supplied. Only connections where gssEncMode is set to prefer or require are affected - the default gssEncMode=allow and all non-GSS-encrypted connections are not - and the write must be at least as long as the driver's 16320-byte GSS buffer (with MIT Kerberos) and issued via setString, setBytes, a ByteStreamWriter, CopyIn.writeToCopy, or LargeObject.write. The CVSS vector (PR:L) indicates an authenticated database session is required, most qualifying writes fail outright with an ArrayIndexOutOfBoundsException rather than leaking, no public exploit is identified at time of analysis, and the upstream project rates this as a genuine but low-priority defect (CVSS 4.2) rather than a high-urgency threat.
Cleartext logging of the monitoring user's password in Canonical's postgresql-operator charm allows an attacker with read access to the Prometheus postgres_exporter logs to recover credentials granting read-only pg_monitor access to PostgreSQL. The flaw (CWE-532) affects charm revisions prior to 1189/1190 on the 14/edge track and prior to 1216/1217 on the 14/stable track, and exploitation additionally requires that a database connection error has occurred so the password is written to logs. This is a modest-severity information-disclosure issue (CVSS 5.3, PR:L) with no public exploit identified at time of analysis, fixed in the specified revisions via upstream patches.
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.
Salt deduction in PostgreSQL Anonymizer prior to 3.2.3 allows an authenticated low-privileged masked role to bypass RESTRICTED function protections by calling anon.hash() from inside a sub-select, collecting (seed, hash_output) pairs and performing an offline brute-force attack to recover the masking salt. This is a low-severity information-disclosure issue (CVSS 4.3, PR:L) that weakens masking guarantees but does not directly reveal plaintext or grant privilege escalation; no public exploit identified at time of analysis and no CISA KEV entry was identified. The issue is fixed in PostgreSQL Anonymizer 3.2.3 and later.
Information disclosure in the automation-controller component of Red Hat Ansible Automation Platform 2 lets any authenticated user of any privilege level extract internal database and ORM structure by sending crafted values through the host_filter query parameter of the Host list REST API. Because HostList.list() catches a bare Exception and returns str(e) verbatim, a malformed relation lookup such as credential__search=x raises a Django FieldError that exposes the complete Host model relation graph (including internal reverse accessors), while a malformed pattern such as name__regex=[bad raises a PostgreSQL DataError that reflects the raw database error string. The flaw is rated CVSS 4.3 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; exploitation requires valid credentials but no user interaction, impact is limited to low-confidentiality schema and error-text leakage with no modification or code execution, and no public exploit was identified at time of analysis.
Unbounded CPU consumption in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to monopolize the pooler's single process by returning an arbitrarily large SCRAM key-derivation iteration count during PgBouncer's own outbound authentication, denying service to every database and client it pools. The prerequisite is a hostile or compromised backend combined with SCRAM-based backend authentication (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H? - assessed as A:H, C:N/I:N, 5.9), so an ordinary external client cannot trigger it, and the derivation cannot be interrupted in frontend builds such as PgBouncer. No public exploit code has been identified and there is no confirmed active exploitation; remediation is to upgrade past 1.25.2 per the vendor changelog.
Presence metadata disclosure in Supabase Realtime before 2.111.2 lets an authenticated WebSocket client on a private channel receive presence_diff messages containing other members' application-defined presence state - location, online-status, roster, viewing or typing data - even when that channel's per-extension row-level security policy explicitly denies presence.read while still granting presence.write. The defect is an authorization-logic error (CWE-863) in how presence diffs were dispatched past the read policy; it is tightly gated by a non-default asymmetric policy configuration, and there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. The vendor's CVSS 6.5 (C:H) likely overstates confidentiality impact, since disclosure is confined to presence metadata and postgres_changes row data is explicitly unaffected, which argues for C:L.
IP allow-list enforcement in Warpgate 0.23.0 through 0.27.2 is bypassed for HTTP API token authentication: when a user has allowed_ip_ranges configured, a presented X-Warpgate-Token is still resolved into a fully authorized RequestAuthorization::UserToken regardless of the source address, so a leaked, phished, or exfiltrated token can be used from a prohibited network location. Impact is limited to confidentiality of what the token-holding user could already read through the HTTP API (CVSS 4.3, C:L/I:N/A:N) - HTTP target proxying and the SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this token flow, and deployments without allowed_ip_ranges are unaffected. The issue is a remote, authenticated weakness (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis, and it is fixed in Warpgate 0.27.3.
Improper exception handling in pg_partman's run_maintenance() function allows an authenticated database role holding partman_user access to permanently stall automated partition maintenance across an entire database. Because the exception handler wraps the whole row-processing loop over part_config rather than each individual partition set, a single crafted row that reliably raises an error - and that is given a low maintenance_order value so it is processed first - immediately aborts the loop and skips every legitimate partition set scheduled after it. Each subsequent maintenance tick (background worker or cron) fails the same way, so child partitions stop being created and retention stops dropping old ones, producing a database-wide availability impact; no public exploit code has been identified at time of analysis and there is no KEV listing, though EPSS and exploitation data were not available in this feed. Fixes are available in pg_partman 5.5.0.
SQL injection in SQLBot (dataease SQLBot) before version 1.9.0 lets an authenticated user read arbitrary files from the host filesystem by abusing the datasource preview endpoint. Because the client-supplied table_name value is interpolated directly into generated SQL without identifier validation, an attacker who can create or configure a datasource pointed at SQLBot's own internal PostgreSQL service can inject calls to pg_read_file(), pg_read_binary_file(), or pg_ls_dir() that remain valid SELECT statements and therefore slip past the read-only policy. In the default tested configuration the internal loopback connection uses PostgreSQL trust authentication, accepts invalid credentials, and executes with superuser rights, so files such as /etc/passwd and /etc/hosts - and potentially configuration files, credentials, and source code - can be returned in the API response; no public exploit code has been identified at time of analysis and the issue is fixed in 1.9.0. Authentication (PR:L) and a reachable/configurable internal datasource are prerequisites, and hardened deployments that disable trusted loopback or run PostgreSQL as a non-superuser largely eliminate the filesystem-read impact.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
Privilege escalation in PostgreSQL Anonymizer (Dalibo) prior to 3.2.0 allows a table owner to execute arbitrary code with full superuser privileges via the `anon.anonymize_database_parallel()` function. The vulnerability (CWE-250, Execution with Unnecessary Privileges) enables a low-to-high privilege escalation within the database server, granting complete C:H/I:H/A:H impact. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.
SQL injection in PostgreSQL Anonymizer's anon.import_database_rules() and anon.import_roles_rules() functions enables privilege escalation to superuser-level code execution within PostgreSQL. A low-privileged database user plants a malicious JSON rules document containing crafted object names (such as schema, table, or column identifiers); when a superuser subsequently invokes either import function, the injected SQL executes with superuser privileges, yielding full database compromise. The vendor has released a fix in version 3.1.4; no public exploit has been identified at time of analysis.
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_length and min_length constraints by submitting Unicode strings whose grapheme count is small but whose codepoint and byte footprint is arbitrarily large. Ash's constraint logic calls Elixir's String.length/1, which counts graphemes; a single base character followed by millions of combining accent codepoints is one grapheme but megabytes of data, satisfying max_length: 2 while writing the entire payload to storage. When the backing store is a PostgreSQL text column, ETS table, or Mnesia table, the oversized value is persisted without limit, enabling storage exhaustion. No public exploit code or CISA KEV listing exists at the time of analysis.
Uncontrolled memory consumption in Grafana's SQL macro evaluator allows authenticated users with query permissions to crash the Grafana server process via a bypass of the prior CVE-2026-33375 fix. By injecting the timeGroup macro into a WHERE clause rather than the positions blocked by the original regex-based patch, attackers cause the macro evaluator to consume unbounded memory, terminating the server. Microsoft SQL Server, PostgreSQL, and MySQL data source integrations are all confirmed affected, and no public exploit has been identified at time of analysis.
Incomplete assistant authorization in langgraph-api (LangGraph Server) versions before 0.10.0 allows an authenticated low-privileged user to bypass ownership controls during run creation and access private assistants belonging to other users. The flaw arises because the run-creation code path dispatched the wrong authorization event (`assistants.search` instead of `assistants.read`), causing custom auth handlers registered only for `assistants.read` to be silently bypassed, the ownership filter to be omitted from the database query, and sensitive assistant `metadata`, `config`, and `context` to be returned in plaintext via the API response. No public exploit code exists and the vendor reports no evidence of exploitation in the wild.
Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Denial of service against PostgreSQL DDL operations is achievable by any authenticated database user who creates a custom type, exploiting missing authorization checks in two specific code paths - range subtype assignment and SQL expression type references. By manufacturing an artificial type dependency through these unguarded paths, a low-privileged user can permanently block administrators from executing ALTER TYPE or DROP TYPE on the affected object, disrupting schema maintenance across PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5). No public exploit code exists and active exploitation has not been confirmed by CISA KEV at time of analysis.
Incorrect ownership reassignment in PostgreSQL's ALTER TABLE ALTER TYPE command allows a table owner to seize control of dependent statistics objects they did not create. Affected versions span all major supported branches prior to 18.5, 17.11, 16.15, 15.19, and 14.24. An authenticated table owner (high-privilege context per CVSS PR:H) can subsequently execute DROP STATISTICS or ALTER STATISTICS against statistics objects owned by another user, while simultaneously locking the legitimate statistics owner out of those same commands. No public exploit code exists and this CVE is not listed in CISA KEV.
Buffer over-read in PostgreSQL's ascii() SQL function exposes up to 3 bytes of heap memory beyond a specific allocation boundary when processing a crafted text value. Authenticated database users on affected versions - PostgreSQL 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5 - can trigger this condition via a malicious SQL query. The vulnerability is a partial information disclosure with limited impact; no public exploit code has been identified at time of analysis.
Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.
PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.
Buffer over-read in PostgreSQL's pg_trgm extension exposes limited heap memory values to authenticated low-privileged users through the side-channel of GiST index picksplit decisions. All four active major release branches are affected - versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit has been identified and active exploitation has not been confirmed; the practical impact is constrained by the indirect, lossy nature of the information disclosure mechanism.
Untrusted search path in PostgreSQL's amcheck extension allows a database user holding EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes by injecting a hostile search_path before calling amcheck. Affected are PostgreSQL major versions 14, 15, 16, and 18 in releases prior to 14.24, 15.19, 16.15, and 18.5 respectively; version 17 is entirely unaffected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the niche exploitation prerequisite of an explicitly granted amcheck EXECUTE privilege.
User enumeration via SCRAM authentication in PostgreSQL 16-18 exposes whether a given username exists by observing differences in the reported SCRAM iteration count during the authentication handshake. An unauthenticated remote attacker can distinguish real accounts from nonexistent ones when the target account uses a non-default scram_iterations value, since the server returns a custom count for real users but the global default for fabricated usernames. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default server configuration.
Stale row-level security policy execution in PostgreSQL 14 through 18 permits authenticated database users to read or modify rows they are no longer authorized to access after role membership, role attributes, or database ownership are changed. The flaw lies in PostgreSQL's plan cache, which does not invalidate cached RLS policies when such privilege changes occur, meaning a revoked permission continues to be honored until the session ends or an unrelated cache invalidation event fires. No public exploit code has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, but the partial data access bypass represents a real confidentiality and integrity risk for applications relying on RLS as a security boundary.
Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.
SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.
Command injection in Dokploy's database backup and restore utilities (prior to v0.29.13) lets an authenticated administrator execute arbitrary shell commands inside managed database containers by supplying crafted values in database name, username, or password configuration fields. All supported database types are affected - PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL - with subsequent-system impact rated High across confidentiality, integrity, and availability, reflecting that injected commands run inside the database containers rather than Dokploy itself. No confirmed active exploitation (not in CISA KEV), but the public fix PR includes functional injection payload examples that effectively demonstrate the technique, and the vendor has confirmed the issue via GitHub Security Advisory GHSA-qc73-mp78-4833.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in `chirpstack/src/storage/device.rs` within both `get_count()` and `list()`, where the tag KEY is concatenated into raw SQL via Rust's `format!()` macro while only the tag VALUE receives safe parameterization through Diesel's `.bind()`. Only deployments using the `chirpstack-sqlite` package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
SQL injection via unescaped identifier interpolation in Kamaji's PostgreSQL and MySQL datastore drivers exposes the shared datastore root connection to arbitrary DDL/DML manipulation. Versions prior to 26.7.4-edge interpolate operator-supplied DataStoreUsername and DataStoreSchema fields directly into SQL via fmt.Sprintf without any identifier sanitization, allowing a quote or backtick character to break out of the identifier context. Compounding the risk, the pre-fix MySQL primary connection had multiStatements=true enabled, enabling stacked query execution over a root-privileged database connection that spans all hosted tenant control planes. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Unauthenticated webhook injection in APIFold corrupts trusted MCP server state by allowing any network client to POST arbitrary JSON payloads to the `/webhooks/:serverSlug/:eventName` endpoint, which are stored in Redis and the `webhook_events` PostgreSQL table without any signature check. All deployments prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 are affected; the flaw is architectural rather than misconfiguration-dependent, as signature validation was never wired into the webhook router. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the attack requires only a valid server slug, making exploitation straightforward for targeted actors.
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.
Full-read server-side request forgery in CloudTAK (npm @tak-ps/cloudtak) v13.5.0 and earlier allows any authenticated user to coerce the API server into fetching attacker-supplied URLs - including the cloud instance metadata endpoint (169.254.169.254), loopback, RFC1918, and CGNAT ranges - with the full internal HTTP response body reflected verbatim in the API reply. The vulnerability exists in the `PUT /api/basemap` endpoint, where user-controlled URLs pass directly from URL parsing to `fetch()` with no IP-address classification and default redirect-following enabled. Three independent bypass classes (direct IP literals, decimal IP encoding, and 302-redirect chain exploitation) are confirmed end-to-end in the published advisory's proof-of-concept; no vendor-released patch is available at time of analysis, and no CISA KEV listing exists, but publicly available exploit code lowers the skill bar significantly.
Cross-tenant step-file disclosure in Activepieces before 0.83.0 allows any authenticated user on a shared instance to retrieve a workflow step-file attachment belonging to a different tenant by exploiting two compounding defects in the `/v1/step-files/signed` download endpoint: a missing JWT audience check and an unguarded null fileId that causes PostgreSQL to return an arbitrary FLOW_STEP_FILE record. Access is strictly read-only and non-targeted - the attacker cannot choose which tenant's file is returned, as the result depends on PostgreSQL's internal scan order at query time. No public exploit has been identified and no active exploitation is listed in CISA KEV; the vulnerability is patched in version 0.83.0.
SQL injection in listmonk's subscriber export endpoint prior to version 6.2.0 allows a highly-privileged authenticated user to read arbitrary PostgreSQL database tables - including users and settings - and execute data-modifying CTEs. The GET /api/subscribers/export endpoint passed a user-controlled query parameter directly into QuerySubscribersForExport in internal/core/subscribers.go without invoking the validateQueryTables guard that the sibling GET /api/subscribers endpoint correctly applies, creating a bypass of the allowlist-based table restriction. Exploitation requires possession of both the subscribers:sql_query and subscribers:get_all permissions; no public exploit code has been identified at time of analysis.
Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user to execute arbitrary OS commands as the NocoBase server process by restoring a crafted backup archive. The database.schema field from a backup's _metadata.json is interpolated directly into a shell command string passed to Node.js child_process.exec(), a classic CWE-78 pattern that bypasses any sanitization at the shell level. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, but the commit diff confirms the mechanism is straightforward and the fix is available in v2.1.19.
PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.
Blind SQL injection in decidim-admin's organization user search endpoint allows authenticated organization administrators to execute arbitrary PostgreSQL expressions inside an ORDER BY clause via the `term` query parameter. The flaw spans decidim-admin versions prior to 0.30.9, 0.31.5, and 0.32.0, and is exploitable using time-based payloads such as `pg_sleep` that return HTTP 200 while leaking data through measurable response-time deltas. No public exploit tool is identified at time of analysis and the vulnerability is not in CISA KEV, but the advisory provides working reproduction steps with a concrete payload, confirming practical exploitability.
SQL injection in Postgrex.Notifications' reconnect replay path allows an attacker who can supply untrusted input as a PostgreSQL LISTEN channel name to corrupt the shared notification connection, silently dropping all channel subscriptions and causing persistent denial of service of the notification subsystem. Affected versions are postgrex 0.16.0 through 0.22.2 in the Elixir ecosystem. No arbitrary SQL execution is possible due to double-quote escaping, and no public exploit or CISA KEV listing exists; the CVSS 4.0 base score of 2.1 reflects the constrained, precondition-heavy impact.
Connection string injection in KEDA's PostgreSQL scaler allows low-privileged tenants to inject arbitrary libpq connection parameters by embedding tab, newline, or other non-space whitespace characters into ScaledObject or TriggerAuthentication configuration fields. The `escapePostgreConnectionParameter` function in `pkg/scalers/postgresql_scaler.go` only detects literal spaces before quoting values, leaving all other libpq token delimiters unescaped; successful exploitation forces TLS downgrade (sslmode=disable) or redirects database connections to attacker-controlled hosts to steal operator-supplied credentials. A working proof-of-concept YAML payload is included in GitHub advisory GHSA-6w3m-4hhp-775q; no CISA KEV listing was present at time of analysis.
PostgreSQL Anonymizer's anon.hash() function exposes its internal salt to masked database users through an offline brute-force attack, undermining the core pseudonymization guarantee of the extension. Masked roles - the primary consumer of this extension - can call anon.hash() with arbitrary seed inputs and accumulate (seed, hash_output) pairs to deduce the salt offline, after which all pseudonymized values in the database become reversible. No active exploitation or public proof-of-concept has been identified; a vendor-confirmed fix is available in version 3.1.2.
SQL injection in n8n's MySQL, PostgreSQL, and Microsoft SQL database integration nodes (all versions before 2.4.0) allows authenticated users with workflow creation permissions to execute arbitrary SQL commands against connected databases by supplying crafted identifier values - table or column names - in node configuration parameters. The nodes failed to escape SQL identifiers when constructing queries, bypassing the safety guarantees users expected from parameterized inputs and enabling injection that directly impacts downstream database confidentiality and integrity. Reported by the NATO Cyber Security Centre; vendor-released patch is confirmed in n8n 2.4.0, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated access to Capgo's /replication HTTP endpoint exposes internal PostgreSQL replication telemetry to any remote attacker, affecting all versions prior to 12.128.2. Attackers can retrieve replication slot names, WAL LSN positions (confirmed_flush_lsn, restart_lsn), and database error messages without supplying any credentials, enabling database infrastructure reconnaissance. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes opportunistic scanning against internet-exposed Capgo deployments trivially feasible.
Low-severity SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}) allows authenticated users to inject arbitrary SQL statements, but only within the privileges of their existing database role. The vulnerability is patched in pgAdmin 4 9.16, with no evidence of active exploitation (EPSS 0.21%, no KEV) and low real-world risk due to the absence of privilege escalation.
Steeltoe.Configuration.Abstractions 4.0.0-4.1.0 permanently exposes TLS client private key material to world-readable temporary files on Linux when Cloud Foundry MySQL or PostgreSQL service bindings supply SSL credentials via VCAP_SERVICES. The Connectors library writes SSL certificate, private key, and CA files to Path.GetTempPath() using File.CreateText, which on Linux creates files at mode 0644 (owner read/write, group read, world read) with no cleanup mechanism, leaving key material readable by any co-located process for the container's lifetime. Vendor-released patch 4.2.0 resolves both the permission issue (restricting new temp files to mode 0600) and the missing cleanup via IDisposable; no public exploit has been identified at time of analysis.
SQL injection in n8n's legacy Postgres v1 and TimescaleDB workflow nodes allows an authenticated workflow editor to inject and execute arbitrary SQL against the connected database, operating under the privileges of the configured database account. Affected versions span all n8n npm releases below 2.25.7 and the 2.26.0-2.26.1 range, with the CVSS 9.9 score reflecting a confirmed scope change: the injection escapes the n8n application layer into the underlying database system (S:C), enabling full confidentiality, integrity, and availability compromise of database contents. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege requirement and network-accessible attack vector make this a critical priority for any deployment where workflow editing access is broadly granted.
Cross-project embedding cache leakage in grepai (versions up to 0.35.0) allows a local low-privileged authenticated user to retrieve cached PostgreSQL embedding vectors belonging to other projects by supplying a known or predicted content_hash value to the LookupByContentHash function. The underlying flaw is a missing project_id scope in the SQL query, meaning any project's embedding vectors can be retrieved by any other authenticated caller who can supply a matching hash. No public exploitation has been confirmed via CISA KEV, but proof-of-concept exploit code has been publicly disclosed per VulDB and GitHub issue #249, and a fix PR (#250) is pending acceptance.
SQL injection in NocoDB's Postgres formula engine exposes authenticated creators to arbitrary SQL execution via the unvalidated `direction` argument of the `ARRAYSORT(...)` formula function. All NocoDB instances on npm/nocodb versions prior to 2026.04.1 using Postgres-backed bases are affected; MySQL and SQLite backends are not. An attacker holding creator/owner-level `columnAdd` permission can inject persistent SQL that executes during column creation and re-executes on every subsequent read of the formula column, enabling confirmed denial-of-service and potentially broader data access depending on database-level permissions. No public exploit identified at time of analysis; this vulnerability is not listed in CISA KEV.
Privilege escalation in PostgreSQL Anonymizer (all versions prior to 3.1.0) allows an authenticated database user to gain superuser privileges by embedding malicious SQL code within a column identifier of a user-created table. When a superuser invokes the k-anonymity function against such a table, the injected code executes with superuser-level privileges, yielding full confidentiality, integrity, and availability impact across the database. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though SSVC rates technical impact as total due to the complete privilege escalation outcome.
Chunk-smuggling in libpng-apng's push-mode APNG parser allows a remote unauthenticated attacker to cause integrity violations and availability disruption when a victim processes a specially crafted APNG file. The flaw - classified under CWE-436 (Interpretation Conflict) - stems from incorrect sequencing of CRC finalization and frame sequence number validation for fcTL and fdAT chunks in pngpread.c, enabling maliciously ordered chunk boundaries to bypass expected parser state transitions. No public exploit code exists at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, it represents a meaningful risk for any image-processing pipeline or application accepting user-supplied APNG data from untrusted sources.
Authenticated users in Mathesar 0.2.0 through 0.9.x can access metadata for PostgreSQL databases where they lack collaborator privileges, due to missing authorization checks in four API methods (collaborators.list, tables.metadata.list, explorations.list, forms.list). Exposed data includes table schemas, saved explorations, form configurations, and critically, public form submission tokens that grant unauthorized database write access under the form's PostgreSQL role. Fixed in version 0.10.0. CVSS 5.3 (Medium) reflects network-accessible, low-complexity exploitation requiring only basic authentication. No public exploit code or active exploitation detected (EPSS data unavailable, not in CISA KEV).
Broken access control in Mathesar 0.2.0 through 0.9.x allows authenticated users to read, modify, or delete saved explorations (database query definitions) in databases where they lack collaborator privileges. Exploitation requires only a valid user account and knowledge of an exploration ID - easily guessed or enumerated. Fixed in version 0.10.0. No public exploit identified at time of analysis, with EPSS data not available for this recently disclosed vulnerability.
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION REFRESH PUBLICATION allows authenticated local or network users with table creation privileges to execute arbitrary SQL queries with the publication subscriber's credentials. The attack is deferred until the next REFRESH PUBLICATION command is executed, requiring user interaction or scheduled maintenance. PostgreSQL 16.x, 17.x, and 18.x versions prior to 16.14, 17.10, and 18.4 respectively are vulnerable; earlier versions are unaffected. No public exploit code or active exploitation has been identified.
SQL injection in PostgreSQL StatementGenerator allows authenticated attackers to execute arbitrary SQL commands through unsanitized object keys in sort, select, and groupBy parameters on analytics endpoints. The vulnerability exists because column name validation was incompletely applied during a previous fix, leaving three query construction methods vulnerable to direct identifier injection. An attacker with valid credentials can exploit this to access or manipulate database contents without requiring user interaction.
Kysely through version 0.28.11 contains a SQL injection vulnerability in JSON path compilation affecting MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() methods directly into single-quoted JSON path string literals without escaping single quotes, enabling attackers to break out of the string context and inject arbitrary SQL. A working proof-of-concept demonstrates UNION-based data exfiltration from SQLite databases. The vulnerability has CVSS score 8.2 and patches are available from the vendor.
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands against connected PostgreSQL, MySQL, and MSSQL databases through the built-in SQL Agent plugin. The vulnerability stems from unsafe string concatenation of table names in the getTableSchemaSql() method across all three database connectors, bypassing proper parameterization. Any user with access to invoke the SQL Agent can exploit this to read, modify, or delete sensitive database contents.
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
Veeam Backup & Replication allows a user with the Backup Viewer role (read-only) to escalate to remote code execution as the postgres database user. A read-only role achieving RCE represents a severe privilege escalation with scope change.
Parse Server versions prior to 9.6.0-alpha.6 and 8.6.32 allow attackers to bypass class-level permission restrictions on protected fields by using dot-notation in query and sort parameters, enabling enumeration of sensitive field values through binary oracle attacks. This affects both MongoDB and PostgreSQL deployments and requires no authentication or user interaction. No patch is currently available for affected versions.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
Command injection in Budibase 3.23.22 and earlier allows authenticated attackers with high privileges to execute arbitrary system commands by injecting malicious values into PostgreSQL connection parameters that are unsanitized in shell command construction. An attacker with administrative access can exploit this vulnerability to gain complete control over the underlying server hosting the Budibase instance. No patch is currently available for this vulnerability.
SQL injection in WeKnora LLM document understanding framework allows authenticated users to extract arbitrary database contents. CVSS 9.9 with scope change. PoC available.
Arbitrary code execution in TimescaleDB 2.23.0 through 2.25.1 allows local authenticated users to execute malicious functions by shadowing built-in PostgreSQL functions through user-writable schemas in the search_path setting during extension upgrades. An attacker with database access can create malicious functions in writable schemas that are invoked instead of legitimate PostgreSQL functions, resulting in code execution with database privileges. No patch is currently available for affected installations.
SQL injection in Chartbrew before 4.8.3. PoC available.
Denial of service in Traefik versions prior to 3.6.8 allows unauthenticated remote attackers to exhaust connection resources by exploiting improper timeout handling in STARTTLS request processing. An attacker can send a PostgreSQL SSLRequest prelude and then stall the connection indefinitely, bypassing the readTimeout protection and accumulating open connections until service availability is degraded. A patch is available in version 3.6.8.
Heap buffer overflow in the pg_trgm extension of PostgreSQL 18.0 and 18.1 allows authenticated database users to trigger memory corruption through specially crafted input strings. An attacker with database access could potentially achieve privilege escalation or cause service disruption, though exploit complexity is currently limited by restricted control over written data. No patch is currently available.
Arbitrary code execution in PostgreSQL results from insufficient validation of multibyte character lengths in text manipulation functions, allowing authenticated database users to trigger buffer overflows and execute commands with database process privileges. Affected versions include PostgreSQL 14.x before 14.21, 15.x before 15.16, 16.x before 16.12, 17.x before 17.8, and all versions before 18.2. No patch is currently available, leaving databases vulnerable to privilege escalation attacks from database-level users.
Arbitrary code execution in PostgreSQL pgcrypto module (versions before 14.21, 15.16, 16.12, 17.8, and 18.2) stems from a heap buffer overflow that allows attackers with database access to execute commands with the privileges of the PostgreSQL system user. An authenticated attacker can exploit this vulnerability by providing specially crafted ciphertext to trigger the overflow condition. No patch is currently available, leaving affected PostgreSQL installations vulnerable to privilege escalation and full system compromise.
PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21 contain insufficient input validation in the intarray extension's selectivity estimator function, enabling authenticated users with object creation privileges to execute arbitrary code with database server privileges. The vulnerability requires valid database credentials but allows complete system compromise through code execution at the OS level. No patch is currently available for affected deployments.
OpenMetadata versions prior to 1.11.8 expose JWT tokens for the privileged ingestion-bot account through the /api/v1/ingestionPipelines API endpoint, allowing any read-only user to escalate privileges and impersonate a highly privileged service account. With public exploit code available and no patch currently deployed on most instances, attackers can perform destructive actions within OpenMetadata and access sensitive metadata that should be restricted by role-based policies. This vulnerability affects OpenMetadata deployments and related systems like PostgreSQL that depend on its authentication tokens.
Privilege escalation in PostgreSQL Anonymizer allows authenticated users with CREATE privileges to gain superuser access by exploiting unsafe function execution within temporary views. This vulnerability affects PostgreSQL 15 and later, with heightened risk on PostgreSQL 14 instances due to default public schema permissions, and impacts all users unable to upgrade to version 3.0.1 or later. No patch is currently available for affected deployments.
PostgreSQL Anonymizer allows authenticated users to escalate to superuser privileges by injecting malicious code into custom operators placed in the public schema, which execute with elevated privileges during extension creation. This vulnerability primarily affects PostgreSQL 14 and instances upgraded from earlier versions, as PostgreSQL 15+ restricts public schema creation permissions by default. A patch is available in PostgreSQL Anonymizer version 3.0.1 and later.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 67.3% and no vendor patch available.
PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperly neutralize quoting syntax, enabling SQL injection when function results are used to construct psql input. This vulnerability was used as the initial access vector in the BeyondTrust RS compromise chain.
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated SQL injection in PeerBanHelper versions 5.0.0 through releases before 9.3.15 enables a high-privileged web API user to read arbitrary data from the configured SQLite, MySQL, or PostgreSQL database by supplying an unrecognized field value to the /api/statistic/analysis/field endpoint. Exploitation requires valid admin-panel credentials (CVSS PR:H) and reachable API access, with no user interaction needed. CVE-2026-62362 is rated medium severity (CVSS 4.9), is fixed in 9.3.15, and has no public exploit identified at time of analysis.
Rate-limit bypass in Better Auth (better-auth and @better-auth/drizzle-adapter 1.6.17 through 1.7.6, plus @better-auth/kysely-adapter 1.6.17 up to but not including 1.7.0) lets remote unauthenticated attackers defeat throttling on password sign-in, two-factor verification, one-time-code and password-reset endpoints by firing bursts of concurrent requests that all pass the limit check before any counter update lands. It is rated moderate (CVSS 4.0 6.3; independent assessment CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because success depends on achieving genuine request concurrency inside a narrow check-then-update window, and the realized impact is defeat of throttling that can enable credential or one-time-code guessing rather than direct data or system compromise. No CISA KEV listing and no public exploit identified at time of analysis; the bypass only applies where the deployment uses Better Auth database-backed rate limiting with a PostgreSQL store and has rate limiting enabled on the targeted endpoints.
Heap memory corruption in psqlODBC versions before 18.00.0005 can be triggered when an application binds 32,769 or more parameters on a single SQL statement via SQLBindParameter. An attacker who controls the parameter count-for example through an untrusted 'IN (?, ?, ...)' list-can wrap the driver's signed 16-bit binding counter, causing a massive out-of-bounds write of zeros that crashes the application or leaves it running with a corrupted heap. No public exploit code has been identified at time of analysis, and exploitation requires a vulnerable application pattern where parameter counts are derived from untrusted input; the flaw is availability-only (CVSS 5.9).
Read-only mode bypass in Tabularis through 0.27.0 lets prompt-injected AI agents or untrusted MCP clients execute data-modifying SQL that the run_query safety gate misclassifies as read-only, allowing side-effecting statements such as setval, nextval, or PostgreSQL query_to_xml with an embedded DELETE to alter or destroy data without triggering an approval prompt. The issue is a local, MCP-channel authorization flaw (assessed CVSS:3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:H/A:H; CVSS 4.0 base 5.8) that only matters when read-only mode is relied upon as a security control against a backend exposing such functions, and the provided CVSS vector indicates no privileges are required (PR:N) while the operator still must interact with the agent (UI:P). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so risk is driven by preconditions-an exposed MCP run_query connection to PostgreSQL-rather than by active exploitation.
Heap memory corruption in Apache DataSketches C++ (datasketches-cpp) versions 4.1.0 through 5.2.0 allows remote attackers to trigger out-of-bounds reads and writes via a crafted Count-Min sketch submitted to the deserialize() function. The flaw combines a missing preamble size check that permits up to 16 bytes over-read on truncated input, and a 32-bit integer overflow in the serialized bucket count that can wrap to zero, resulting in an empty table and subsequent heap memory corruption during updates or estimate queries. Exploitation requires an application to deserialize Count-Min sketches from untrusted sources; no public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the severity as moderate.
Cleartext database credential disclosure via man-in-the-middle interception affects pgjdbc (PostgreSQL JDBC Driver) versions 42.7.11 through 42.7.13 when the caller-supplied requireAuth connection property is set to exclude all six authentication methods the driver recognizes (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or to a value containing no method at all (requireAuth=, a single comma). In that state the driver fails open and accepts whatever method the server requests, including cleartext password authentication, so an attacker who already holds an active man-in-the-middle position between the application and the PostgreSQL server can request cleartext authentication and capture the database password. Exposure is narrow: requireAuth has no default value, so deployments that never set the property are unaffected, and positive lists (requireAuth=scram-sha-256) or partial exclusions (requireAuth=!password,!md5) are enforced correctly; no public exploit identified at time of analysis and the issue is not in CISA KEV. Scoring is confidentiality-only at CVSS 5.9 with high attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting that both a specific client misconfiguration and a pre-existing network foothold are required.
Residual-data disclosure in the PostgreSQL JDBC Driver (pgjdbc) 42.7.4 through 42.7.13 allows an authenticated attacker who can influence how an application writes a value to recover SQL text and parameter values belonging to earlier statements on the same connection. When an application declares a value length larger than the bytes it actually supplies through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes, the driver pads the shortfall with whatever bytes remain in its send buffer instead of zeros, exposing up to 8192 bytes of recent traffic per value (16320 bytes when GSS encryption is in use); on a pooled connection those bytes may belong to other tenants or requests. Exploitation is conditional rather than trivial: the affected application must both store and read back such a padded value, its declared lengths must not always match its data, and any cross-request leakage depends on connection pooling, which is why the vendor rates this 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV).
Values written through the PostgreSQL JDBC Driver (pgjdbc) 42.7.4 and 42.7.5 over a GSS/Kerberos-encrypted connection can be silently stored by the server with bytes from the driver's previous GSS send buffer spliced into the front of them, so the persisted value holds earlier SQL text, other bind parameters, or earlier rows of the same batch instead of what the application supplied. Only connections where gssEncMode is set to prefer or require are affected - the default gssEncMode=allow and all non-GSS-encrypted connections are not - and the write must be at least as long as the driver's 16320-byte GSS buffer (with MIT Kerberos) and issued via setString, setBytes, a ByteStreamWriter, CopyIn.writeToCopy, or LargeObject.write. The CVSS vector (PR:L) indicates an authenticated database session is required, most qualifying writes fail outright with an ArrayIndexOutOfBoundsException rather than leaking, no public exploit is identified at time of analysis, and the upstream project rates this as a genuine but low-priority defect (CVSS 4.2) rather than a high-urgency threat.
Cleartext logging of the monitoring user's password in Canonical's postgresql-operator charm allows an attacker with read access to the Prometheus postgres_exporter logs to recover credentials granting read-only pg_monitor access to PostgreSQL. The flaw (CWE-532) affects charm revisions prior to 1189/1190 on the 14/edge track and prior to 1216/1217 on the 14/stable track, and exploitation additionally requires that a database connection error has occurred so the password is written to logs. This is a modest-severity information-disclosure issue (CVSS 5.3, PR:L) with no public exploit identified at time of analysis, fixed in the specified revisions via upstream patches.
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.
Salt deduction in PostgreSQL Anonymizer prior to 3.2.3 allows an authenticated low-privileged masked role to bypass RESTRICTED function protections by calling anon.hash() from inside a sub-select, collecting (seed, hash_output) pairs and performing an offline brute-force attack to recover the masking salt. This is a low-severity information-disclosure issue (CVSS 4.3, PR:L) that weakens masking guarantees but does not directly reveal plaintext or grant privilege escalation; no public exploit identified at time of analysis and no CISA KEV entry was identified. The issue is fixed in PostgreSQL Anonymizer 3.2.3 and later.
Information disclosure in the automation-controller component of Red Hat Ansible Automation Platform 2 lets any authenticated user of any privilege level extract internal database and ORM structure by sending crafted values through the host_filter query parameter of the Host list REST API. Because HostList.list() catches a bare Exception and returns str(e) verbatim, a malformed relation lookup such as credential__search=x raises a Django FieldError that exposes the complete Host model relation graph (including internal reverse accessors), while a malformed pattern such as name__regex=[bad raises a PostgreSQL DataError that reflects the raw database error string. The flaw is rated CVSS 4.3 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N; exploitation requires valid credentials but no user interaction, impact is limited to low-confidentiality schema and error-text leakage with no modification or code execution, and no public exploit was identified at time of analysis.
Unbounded CPU consumption in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to monopolize the pooler's single process by returning an arbitrarily large SCRAM key-derivation iteration count during PgBouncer's own outbound authentication, denying service to every database and client it pools. The prerequisite is a hostile or compromised backend combined with SCRAM-based backend authentication (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H? - assessed as A:H, C:N/I:N, 5.9), so an ordinary external client cannot trigger it, and the derivation cannot be interrupted in frontend builds such as PgBouncer. No public exploit code has been identified and there is no confirmed active exploitation; remediation is to upgrade past 1.25.2 per the vendor changelog.
Presence metadata disclosure in Supabase Realtime before 2.111.2 lets an authenticated WebSocket client on a private channel receive presence_diff messages containing other members' application-defined presence state - location, online-status, roster, viewing or typing data - even when that channel's per-extension row-level security policy explicitly denies presence.read while still granting presence.write. The defect is an authorization-logic error (CWE-863) in how presence diffs were dispatched past the read policy; it is tightly gated by a non-default asymmetric policy configuration, and there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. The vendor's CVSS 6.5 (C:H) likely overstates confidentiality impact, since disclosure is confined to presence metadata and postgres_changes row data is explicitly unaffected, which argues for C:L.
IP allow-list enforcement in Warpgate 0.23.0 through 0.27.2 is bypassed for HTTP API token authentication: when a user has allowed_ip_ranges configured, a presented X-Warpgate-Token is still resolved into a fully authorized RequestAuthorization::UserToken regardless of the source address, so a leaked, phished, or exfiltrated token can be used from a prohibited network location. Impact is limited to confidentiality of what the token-holding user could already read through the HTTP API (CVSS 4.3, C:L/I:N/A:N) - HTTP target proxying and the SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this token flow, and deployments without allowed_ip_ranges are unaffected. The issue is a remote, authenticated weakness (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis, and it is fixed in Warpgate 0.27.3.
Improper exception handling in pg_partman's run_maintenance() function allows an authenticated database role holding partman_user access to permanently stall automated partition maintenance across an entire database. Because the exception handler wraps the whole row-processing loop over part_config rather than each individual partition set, a single crafted row that reliably raises an error - and that is given a low maintenance_order value so it is processed first - immediately aborts the loop and skips every legitimate partition set scheduled after it. Each subsequent maintenance tick (background worker or cron) fails the same way, so child partitions stop being created and retention stops dropping old ones, producing a database-wide availability impact; no public exploit code has been identified at time of analysis and there is no KEV listing, though EPSS and exploitation data were not available in this feed. Fixes are available in pg_partman 5.5.0.
SQL injection in SQLBot (dataease SQLBot) before version 1.9.0 lets an authenticated user read arbitrary files from the host filesystem by abusing the datasource preview endpoint. Because the client-supplied table_name value is interpolated directly into generated SQL without identifier validation, an attacker who can create or configure a datasource pointed at SQLBot's own internal PostgreSQL service can inject calls to pg_read_file(), pg_read_binary_file(), or pg_ls_dir() that remain valid SELECT statements and therefore slip past the read-only policy. In the default tested configuration the internal loopback connection uses PostgreSQL trust authentication, accepts invalid credentials, and executes with superuser rights, so files such as /etc/passwd and /etc/hosts - and potentially configuration files, credentials, and source code - can be returned in the API response; no public exploit code has been identified at time of analysis and the issue is fixed in 1.9.0. Authentication (PR:L) and a reachable/configurable internal datasource are prerequisites, and hardened deployments that disable trusted loopback or run PostgreSQL as a non-superuser largely eliminate the filesystem-read impact.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
Privilege escalation in PostgreSQL Anonymizer (Dalibo) prior to 3.2.0 allows a table owner to execute arbitrary code with full superuser privileges via the `anon.anonymize_database_parallel()` function. The vulnerability (CWE-250, Execution with Unnecessary Privileges) enables a low-to-high privilege escalation within the database server, granting complete C:H/I:H/A:H impact. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.
SQL injection in PostgreSQL Anonymizer's anon.import_database_rules() and anon.import_roles_rules() functions enables privilege escalation to superuser-level code execution within PostgreSQL. A low-privileged database user plants a malicious JSON rules document containing crafted object names (such as schema, table, or column identifiers); when a superuser subsequently invokes either import function, the injected SQL executes with superuser privileges, yielding full database compromise. The vendor has released a fix in version 3.1.4; no public exploit has been identified at time of analysis.
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_length and min_length constraints by submitting Unicode strings whose grapheme count is small but whose codepoint and byte footprint is arbitrarily large. Ash's constraint logic calls Elixir's String.length/1, which counts graphemes; a single base character followed by millions of combining accent codepoints is one grapheme but megabytes of data, satisfying max_length: 2 while writing the entire payload to storage. When the backing store is a PostgreSQL text column, ETS table, or Mnesia table, the oversized value is persisted without limit, enabling storage exhaustion. No public exploit code or CISA KEV listing exists at the time of analysis.
Uncontrolled memory consumption in Grafana's SQL macro evaluator allows authenticated users with query permissions to crash the Grafana server process via a bypass of the prior CVE-2026-33375 fix. By injecting the timeGroup macro into a WHERE clause rather than the positions blocked by the original regex-based patch, attackers cause the macro evaluator to consume unbounded memory, terminating the server. Microsoft SQL Server, PostgreSQL, and MySQL data source integrations are all confirmed affected, and no public exploit has been identified at time of analysis.
Incomplete assistant authorization in langgraph-api (LangGraph Server) versions before 0.10.0 allows an authenticated low-privileged user to bypass ownership controls during run creation and access private assistants belonging to other users. The flaw arises because the run-creation code path dispatched the wrong authorization event (`assistants.search` instead of `assistants.read`), causing custom auth handlers registered only for `assistants.read` to be silently bypassed, the ownership filter to be omitted from the database query, and sensitive assistant `metadata`, `config`, and `context` to be returned in plaintext via the API response. No public exploit code exists and the vendor reports no evidence of exploitation in the wild.
Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Denial of service against PostgreSQL DDL operations is achievable by any authenticated database user who creates a custom type, exploiting missing authorization checks in two specific code paths - range subtype assignment and SQL expression type references. By manufacturing an artificial type dependency through these unguarded paths, a low-privileged user can permanently block administrators from executing ALTER TYPE or DROP TYPE on the affected object, disrupting schema maintenance across PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5). No public exploit code exists and active exploitation has not been confirmed by CISA KEV at time of analysis.
Incorrect ownership reassignment in PostgreSQL's ALTER TABLE ALTER TYPE command allows a table owner to seize control of dependent statistics objects they did not create. Affected versions span all major supported branches prior to 18.5, 17.11, 16.15, 15.19, and 14.24. An authenticated table owner (high-privilege context per CVSS PR:H) can subsequently execute DROP STATISTICS or ALTER STATISTICS against statistics objects owned by another user, while simultaneously locking the legitimate statistics owner out of those same commands. No public exploit code exists and this CVE is not listed in CISA KEV.
Buffer over-read in PostgreSQL's ascii() SQL function exposes up to 3 bytes of heap memory beyond a specific allocation boundary when processing a crafted text value. Authenticated database users on affected versions - PostgreSQL 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5 - can trigger this condition via a malicious SQL query. The vulnerability is a partial information disclosure with limited impact; no public exploit code has been identified at time of analysis.
Integer underflow in PostgreSQL's Embedded C preprocessor (ECPG) client allows a database server administrator to crash ECPG client applications by sending a specially crafted bytea value missing its mandatory prefix. Affected versions span all active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The primary impact is temporary denial of service against the ECPG client process via SIGSEGV, with a rare secondary risk of low-severity client-side integrity corruption; no public exploit has been identified at time of analysis.
PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.
Buffer over-read in PostgreSQL's pg_trgm extension exposes limited heap memory values to authenticated low-privileged users through the side-channel of GiST index picksplit decisions. All four active major release branches are affected - versions before 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit has been identified and active exploitation has not been confirmed; the practical impact is constrained by the indirect, lossy nature of the information disclosure mechanism.
Untrusted search path in PostgreSQL's amcheck extension allows a database user holding EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes by injecting a hostile search_path before calling amcheck. Affected are PostgreSQL major versions 14, 15, 16, and 18 in releases prior to 14.24, 15.19, 16.15, and 18.5 respectively; version 17 is entirely unaffected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the niche exploitation prerequisite of an explicitly granted amcheck EXECUTE privilege.
User enumeration via SCRAM authentication in PostgreSQL 16-18 exposes whether a given username exists by observing differences in the reported SCRAM iteration count during the authentication handshake. An unauthenticated remote attacker can distinguish real accounts from nonexistent ones when the target account uses a non-default scram_iterations value, since the server returns a custom count for real users but the global default for fabricated usernames. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default server configuration.
Stale row-level security policy execution in PostgreSQL 14 through 18 permits authenticated database users to read or modify rows they are no longer authorized to access after role membership, role attributes, or database ownership are changed. The flaw lies in PostgreSQL's plan cache, which does not invalidate cached RLS policies when such privilege changes occur, meaning a revoked permission continues to be honored until the session ends or an unrelated cache invalidation event fires. No public exploit code has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, but the partial data access bypass represents a real confidentiality and integrity risk for applications relying on RLS as a security boundary.
Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.
SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.
Command injection in Dokploy's database backup and restore utilities (prior to v0.29.13) lets an authenticated administrator execute arbitrary shell commands inside managed database containers by supplying crafted values in database name, username, or password configuration fields. All supported database types are affected - PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL - with subsequent-system impact rated High across confidentiality, integrity, and availability, reflecting that injected commands run inside the database containers rather than Dokploy itself. No confirmed active exploitation (not in CISA KEV), but the public fix PR includes functional injection payload examples that effectively demonstrate the technique, and the vendor has confirmed the issue via GitHub Security Advisory GHSA-qc73-mp78-4833.
Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.
SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in `chirpstack/src/storage/device.rs` within both `get_count()` and `list()`, where the tag KEY is concatenated into raw SQL via Rust's `format!()` macro while only the tag VALUE receives safe parameterization through Diesel's `.bind()`. Only deployments using the `chirpstack-sqlite` package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
SQL injection via unescaped identifier interpolation in Kamaji's PostgreSQL and MySQL datastore drivers exposes the shared datastore root connection to arbitrary DDL/DML manipulation. Versions prior to 26.7.4-edge interpolate operator-supplied DataStoreUsername and DataStoreSchema fields directly into SQL via fmt.Sprintf without any identifier sanitization, allowing a quote or backtick character to break out of the identifier context. Compounding the risk, the pre-fix MySQL primary connection had multiStatements=true enabled, enabling stacked query execution over a root-privileged database connection that spans all hosted tenant control planes. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Unauthenticated webhook injection in APIFold corrupts trusted MCP server state by allowing any network client to POST arbitrary JSON payloads to the `/webhooks/:serverSlug/:eventName` endpoint, which are stored in Redis and the `webhook_events` PostgreSQL table without any signature check. All deployments prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 are affected; the flaw is architectural rather than misconfiguration-dependent, as signature validation was never wired into the webhook router. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the attack requires only a valid server slug, making exploitation straightforward for targeted actors.
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.
Full-read server-side request forgery in CloudTAK (npm @tak-ps/cloudtak) v13.5.0 and earlier allows any authenticated user to coerce the API server into fetching attacker-supplied URLs - including the cloud instance metadata endpoint (169.254.169.254), loopback, RFC1918, and CGNAT ranges - with the full internal HTTP response body reflected verbatim in the API reply. The vulnerability exists in the `PUT /api/basemap` endpoint, where user-controlled URLs pass directly from URL parsing to `fetch()` with no IP-address classification and default redirect-following enabled. Three independent bypass classes (direct IP literals, decimal IP encoding, and 302-redirect chain exploitation) are confirmed end-to-end in the published advisory's proof-of-concept; no vendor-released patch is available at time of analysis, and no CISA KEV listing exists, but publicly available exploit code lowers the skill bar significantly.
Cross-tenant step-file disclosure in Activepieces before 0.83.0 allows any authenticated user on a shared instance to retrieve a workflow step-file attachment belonging to a different tenant by exploiting two compounding defects in the `/v1/step-files/signed` download endpoint: a missing JWT audience check and an unguarded null fileId that causes PostgreSQL to return an arbitrary FLOW_STEP_FILE record. Access is strictly read-only and non-targeted - the attacker cannot choose which tenant's file is returned, as the result depends on PostgreSQL's internal scan order at query time. No public exploit has been identified and no active exploitation is listed in CISA KEV; the vulnerability is patched in version 0.83.0.
SQL injection in listmonk's subscriber export endpoint prior to version 6.2.0 allows a highly-privileged authenticated user to read arbitrary PostgreSQL database tables - including users and settings - and execute data-modifying CTEs. The GET /api/subscribers/export endpoint passed a user-controlled query parameter directly into QuerySubscribersForExport in internal/core/subscribers.go without invoking the validateQueryTables guard that the sibling GET /api/subscribers endpoint correctly applies, creating a bypass of the allowlist-based table restriction. Exploitation requires possession of both the subscribers:sql_query and subscribers:get_all permissions; no public exploit code has been identified at time of analysis.
Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user to execute arbitrary OS commands as the NocoBase server process by restoring a crafted backup archive. The database.schema field from a backup's _metadata.json is interpolated directly into a shell command string passed to Node.js child_process.exec(), a classic CWE-78 pattern that bypasses any sanitization at the shell level. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, but the commit diff confirms the mechanism is straightforward and the fix is available in v2.1.19.
PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_shadow credential hashes and database metadata by submitting raw SQL queries that reference system catalog tables omitted from the checkSQL() keyword blacklist. The SQL Collection plugin's blocklist-based validation failed to restrict pg_shadow, pg_roles, pg_stat_activity, and information_schema, and the commit diff confirms the bypass also worked via subquery wrapping (e.g., SELECT * FROM (SELECT usename, passwd FROM pg_shadow) AS passwords). No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; a vendor-released patch is available in v2.1.0-alpha.46.
Blind SQL injection in decidim-admin's organization user search endpoint allows authenticated organization administrators to execute arbitrary PostgreSQL expressions inside an ORDER BY clause via the `term` query parameter. The flaw spans decidim-admin versions prior to 0.30.9, 0.31.5, and 0.32.0, and is exploitable using time-based payloads such as `pg_sleep` that return HTTP 200 while leaking data through measurable response-time deltas. No public exploit tool is identified at time of analysis and the vulnerability is not in CISA KEV, but the advisory provides working reproduction steps with a concrete payload, confirming practical exploitability.
SQL injection in Postgrex.Notifications' reconnect replay path allows an attacker who can supply untrusted input as a PostgreSQL LISTEN channel name to corrupt the shared notification connection, silently dropping all channel subscriptions and causing persistent denial of service of the notification subsystem. Affected versions are postgrex 0.16.0 through 0.22.2 in the Elixir ecosystem. No arbitrary SQL execution is possible due to double-quote escaping, and no public exploit or CISA KEV listing exists; the CVSS 4.0 base score of 2.1 reflects the constrained, precondition-heavy impact.
Connection string injection in KEDA's PostgreSQL scaler allows low-privileged tenants to inject arbitrary libpq connection parameters by embedding tab, newline, or other non-space whitespace characters into ScaledObject or TriggerAuthentication configuration fields. The `escapePostgreConnectionParameter` function in `pkg/scalers/postgresql_scaler.go` only detects literal spaces before quoting values, leaving all other libpq token delimiters unescaped; successful exploitation forces TLS downgrade (sslmode=disable) or redirects database connections to attacker-controlled hosts to steal operator-supplied credentials. A working proof-of-concept YAML payload is included in GitHub advisory GHSA-6w3m-4hhp-775q; no CISA KEV listing was present at time of analysis.
PostgreSQL Anonymizer's anon.hash() function exposes its internal salt to masked database users through an offline brute-force attack, undermining the core pseudonymization guarantee of the extension. Masked roles - the primary consumer of this extension - can call anon.hash() with arbitrary seed inputs and accumulate (seed, hash_output) pairs to deduce the salt offline, after which all pseudonymized values in the database become reversible. No active exploitation or public proof-of-concept has been identified; a vendor-confirmed fix is available in version 3.1.2.
SQL injection in n8n's MySQL, PostgreSQL, and Microsoft SQL database integration nodes (all versions before 2.4.0) allows authenticated users with workflow creation permissions to execute arbitrary SQL commands against connected databases by supplying crafted identifier values - table or column names - in node configuration parameters. The nodes failed to escape SQL identifiers when constructing queries, bypassing the safety guarantees users expected from parameterized inputs and enabling injection that directly impacts downstream database confidentiality and integrity. Reported by the NATO Cyber Security Centre; vendor-released patch is confirmed in n8n 2.4.0, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated access to Capgo's /replication HTTP endpoint exposes internal PostgreSQL replication telemetry to any remote attacker, affecting all versions prior to 12.128.2. Attackers can retrieve replication slot names, WAL LSN positions (confirmed_flush_lsn, restart_lsn), and database error messages without supplying any credentials, enabling database infrastructure reconnaissance. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes opportunistic scanning against internet-exposed Capgo deployments trivially feasible.
Low-severity SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}) allows authenticated users to inject arbitrary SQL statements, but only within the privileges of their existing database role. The vulnerability is patched in pgAdmin 4 9.16, with no evidence of active exploitation (EPSS 0.21%, no KEV) and low real-world risk due to the absence of privilege escalation.
Steeltoe.Configuration.Abstractions 4.0.0-4.1.0 permanently exposes TLS client private key material to world-readable temporary files on Linux when Cloud Foundry MySQL or PostgreSQL service bindings supply SSL credentials via VCAP_SERVICES. The Connectors library writes SSL certificate, private key, and CA files to Path.GetTempPath() using File.CreateText, which on Linux creates files at mode 0644 (owner read/write, group read, world read) with no cleanup mechanism, leaving key material readable by any co-located process for the container's lifetime. Vendor-released patch 4.2.0 resolves both the permission issue (restricting new temp files to mode 0600) and the missing cleanup via IDisposable; no public exploit has been identified at time of analysis.
SQL injection in n8n's legacy Postgres v1 and TimescaleDB workflow nodes allows an authenticated workflow editor to inject and execute arbitrary SQL against the connected database, operating under the privileges of the configured database account. Affected versions span all n8n npm releases below 2.25.7 and the 2.26.0-2.26.1 range, with the CVSS 9.9 score reflecting a confirmed scope change: the injection escapes the n8n application layer into the underlying database system (S:C), enabling full confidentiality, integrity, and availability compromise of database contents. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege requirement and network-accessible attack vector make this a critical priority for any deployment where workflow editing access is broadly granted.
Cross-project embedding cache leakage in grepai (versions up to 0.35.0) allows a local low-privileged authenticated user to retrieve cached PostgreSQL embedding vectors belonging to other projects by supplying a known or predicted content_hash value to the LookupByContentHash function. The underlying flaw is a missing project_id scope in the SQL query, meaning any project's embedding vectors can be retrieved by any other authenticated caller who can supply a matching hash. No public exploitation has been confirmed via CISA KEV, but proof-of-concept exploit code has been publicly disclosed per VulDB and GitHub issue #249, and a fix PR (#250) is pending acceptance.
SQL injection in NocoDB's Postgres formula engine exposes authenticated creators to arbitrary SQL execution via the unvalidated `direction` argument of the `ARRAYSORT(...)` formula function. All NocoDB instances on npm/nocodb versions prior to 2026.04.1 using Postgres-backed bases are affected; MySQL and SQLite backends are not. An attacker holding creator/owner-level `columnAdd` permission can inject persistent SQL that executes during column creation and re-executes on every subsequent read of the formula column, enabling confirmed denial-of-service and potentially broader data access depending on database-level permissions. No public exploit identified at time of analysis; this vulnerability is not listed in CISA KEV.
Privilege escalation in PostgreSQL Anonymizer (all versions prior to 3.1.0) allows an authenticated database user to gain superuser privileges by embedding malicious SQL code within a column identifier of a user-created table. When a superuser invokes the k-anonymity function against such a table, the injected code executes with superuser-level privileges, yielding full confidentiality, integrity, and availability impact across the database. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though SSVC rates technical impact as total due to the complete privilege escalation outcome.
Chunk-smuggling in libpng-apng's push-mode APNG parser allows a remote unauthenticated attacker to cause integrity violations and availability disruption when a victim processes a specially crafted APNG file. The flaw - classified under CWE-436 (Interpretation Conflict) - stems from incorrect sequencing of CRC finalization and frame sequence number validation for fcTL and fdAT chunks in pngpread.c, enabling maliciously ordered chunk boundaries to bypass expected parser state transitions. No public exploit code exists at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, it represents a meaningful risk for any image-processing pipeline or application accepting user-supplied APNG data from untrusted sources.
Authenticated users in Mathesar 0.2.0 through 0.9.x can access metadata for PostgreSQL databases where they lack collaborator privileges, due to missing authorization checks in four API methods (collaborators.list, tables.metadata.list, explorations.list, forms.list). Exposed data includes table schemas, saved explorations, form configurations, and critically, public form submission tokens that grant unauthorized database write access under the form's PostgreSQL role. Fixed in version 0.10.0. CVSS 5.3 (Medium) reflects network-accessible, low-complexity exploitation requiring only basic authentication. No public exploit code or active exploitation detected (EPSS data unavailable, not in CISA KEV).
Broken access control in Mathesar 0.2.0 through 0.9.x allows authenticated users to read, modify, or delete saved explorations (database query definitions) in databases where they lack collaborator privileges. Exploitation requires only a valid user account and knowledge of an exploration ID - easily guessed or enumerated. Fixed in version 0.10.0. No public exploit identified at time of analysis, with EPSS data not available for this recently disclosed vulnerability.
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION REFRESH PUBLICATION allows authenticated local or network users with table creation privileges to execute arbitrary SQL queries with the publication subscriber's credentials. The attack is deferred until the next REFRESH PUBLICATION command is executed, requiring user interaction or scheduled maintenance. PostgreSQL 16.x, 17.x, and 18.x versions prior to 16.14, 17.10, and 18.4 respectively are vulnerable; earlier versions are unaffected. No public exploit code or active exploitation has been identified.