8 matches found
CVE-2026-120153
A flaw was found in PostgreSQL. An authenticated user with database-level CREATE privileges can execute arbitrary code as the administrative superuser through a Structured Query Language SQL injection vulnerability in extension-script substitutions. By supplying a crafted schema or owner name...
CVE-2026-120153
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...
CVE-2026-120153
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...
EUVD-2026-124427
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...
CVE-2026-120153: n/a PostgreSQL: SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to…
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...
PT-2026-145839
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...
Vulnerability in core server (CVE-2026-120153)
PostgreSQL extension-script substitutions allow SQL injection through object names SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newline...
USN-6296-1 postgresql-12, postgresql-14, postgresql-15 vulnerabilities
It was discovered that PostgreSQL incorrectly handled certain extension script substitutions. An attacker having database-level CREATE privileges can use this issue to execute arbitrary code as the bootstrap superuser. CVE-2023-39417 It was discovered that PostgreSQL incorrectly handled the MERGE...