CVE-2026-15742

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

DB_Audit_Research

Audit che si auto-sconfiggono — laboratorio riproducibile Licenza: MIT codice / CC BY 4.0 documentazione Ricerca sulla sicurezza difensiva che verifica se un ruolo di database a bassi privilegi, solo injection possa accecare reversibilmente un auditor basato su trigger e avvelenare l'attribuzione...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2026-14680

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments. Mitigation Restrict PostgreSQL to trusted hosts and bind only the required interfaces; use pghba.conf...

CVE-2026-14664

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...

CVE-2026-19385

A flaw was found in PostgreSQL pgdump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

CVE-2026-14662

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

cve-2026-9082

CVE-2026-9082 Tipo : SQL Injection CWE-89 Prodotto interessato : Drupal Core API di astrazione del database Avviso Drupal : SA-CORE-2026-004 Pubblicato : 20 maggio 2026 Gravità : Altamente Critica Drupal 20/25 | NVD CVSS 6.5 Cos'è? CVE-2026-9082 è una vulnerabilità di SQL Injection nell'API di...

cve-2019-9193

CVE-2019-9193 • CVE-2019-9193 Schwachstelle PostgreSQL weist eine Schwachstelle auf, die es ermöglicht, über die Funktion „COPY TO / FROM PROGRAM“ beliebigen Code im Betriebssystem der Datenbank auszuführen. Angriffsvektor: Benutzer, die Mitglied der Gruppe „SuperUser“ oder „pgexecuteserverprogra...

CVE-2020-7471

CVE-2020-7471 Dieses Repository bietet die Umgebung und den POC für die Sicherheitslücke CVE-2020-7471 Potential SQL injection via StringAggdelimiter Betroffene django Versionen 1.11 bis 1.11.28 exklusive 2.2 bis 2.2.10 exklusive 3.0 bis 3.0.3 exklusive Vor der Nutzung sind folgende Schritte...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL-Injection-Schwachstelle im Drupal Core Hochwirksame SQL-Injection-Schwachstelle im Drupal Core PostgreSQL 📋 Übersicht CVE-2026-9082 ist eine SQL-Injection -Schwachstelle in der Datenbank-Abstraktionsschicht von Drupal Core. Sie betrifft nur Websites, die PostgreSQL als...

CVE-2026-20253

🚨 CVE-2026-20253 - Vulnerabilità critica di creazione file non autenticata in Splunk Enterprise Vulnerabilità di creazione e troncamento arbitrario di file non autenticata che colpisce Splunk Enterprise e Splunk Cloud Platform. 📖 Sommario Esecutivo CVE-2026-20253 è una vulnerabilità critica in...

CVE-2026-44706

SQL Injection in Chatwoot FilterService Una proof-of-concept per CVE-2026-44706, una vulnerabilità di SQL Injection nel FilterServiceltgtfiltervalues di Chatwoot che permette a qualsiasi agente autenticato di leggere l'intero database PostgreSQL, incluse le credenziali utente e i token API. Leggi...

CVE-2026-9082

CVE-2026-9082 Iniezione SQL non autenticata in Drupal Core su PostgreSQL tramite POST /user/login, escalata a esecuzione remota di codice attraverso sessionpreloadlibraries di PostgreSQL. A differenza degli exploit pubblici esistenti che prendono di mira JSON:API, questo utilizza l'endpoint di...

django_cve201919844

djangocve201919844poc PoC für CVE-2019-19844 Anforderungen Python 3.7.x PostgreSQL 9.5 oder höher Einrichtung 1. Datenbank erstellen z.B. djangocve201919844poc 2. Setze den Datenbanknamen auf die Umgebungsvariable DJANGODATABASENAME z.B. export DJANGODATABASENAME=djangocve201919844poc 3. Führe au...

Apache Superset < 4.0.2 - SQL Injection

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

CVE-2026-14669

CVE-2026-14669 - Heap buffer overflow dell'abbreviazione del fuso orario in PostgreSQL tochar La funzione tochar di PostgreSQL presenta una vulnerabilità di heap buffer overflow durante la formattazione del fuso orario. Impostando un'abbreviazione POSIX del fuso orario eccessivamente lunga, un...

heartbleeder

Heartbleeder Verifica i tuoi server per la vulnerabilità OpenSSL CVE-2014-0160 nota anche come Heartbleed. ATTENZIONE : Non viene fornita alcuna garanzia sull'accuratezza dei risultati; dovresti verificarli in modo indipendente controllando la tua build di OpenSSL. Pull request benvenute. Utilizz...

CVE-2025-1094-PoC-Postgre-SQLi

Analyse von CVE-2025-1094 und Emulations-Setup Diese detaillierte Untersuchung, durchgeführt am 14. März 2025, untersucht CVE-2025-1094, eine hypothetische SQL-Injection-Schwachstelle mit hohem Schweregrad in PostgreSQL, basierend auf dem bereitgestellten Emulations-Setup und der Ausführung des...