SQL Injection

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to SQL Injection via the Literal function. An attacker can execute arbitrary SQL commands, manipulate database schema, or exfiltrate data by injecting crafted inpu...

SQL Injection

Overview @saltcorn/data is a Data models for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to SQL Injection via the Literal function. An attacker can execute arbitrary SQL commands, manipulate database schema, or exfiltrate data by injecting crafted input...

SQL Injection

Overview pg8000 is a PostgreSQL interface library Affected versions of this package are vulnerable to SQL Injection via the literal function. An attacker can execute arbitrary SQL commands by supplying a specially crafted Python list as input. Remediation Upgrade pg8000 to version 1.31.5 or highe...