CVE-2023-22626

PgHero (Python/DB admin dashboard for PostgreSQL) prior to 3.1.0 contains a confidentiality flaw where the EXPLAIN path can leak query results via error messages. The root cause is information disclosure in error responses, which may expose database content or, in some cases, file contents on the...

CVE-2023-22626

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server...