EUVD-2025-18190

Malicious code in bioql PyPI...

SQL Injection

pg-promise is vulnerable to SQL Injection. The vulnerability is due to improper handling of negative numbers, which allows an attacker to manipulate SQL queries by injecting malicious input...

CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

@emuanalytics/flow-pipelines (>=0.0.1, <=1.4.2), @evdhiggins/airtable-sync (0.2.6) +10 more potentially affected by CVE-2025-29744 via pg-promise (>=11.0.0, <=11.5.4)

pg-promise NPM version =11.0.0, =0.0.1, =1.0.1, =1.2.1, =6.1.0-alpha.7, =2.4.46, =1.0.1, =0.29.0, =6.1.0-alpha.3, =2.0.0, =2.0.1 Source cves: CVE-2025-29744 Source advisory: OSV:GHSA-FF9H-848C-4XFJ...

@emuanalytics/flow-pipelines (>=0.0.1, <=1.4.2), @evdhiggins/airtable-sync (0.2.6) +10 more potentially affected by CVE-2025-29744 via pg-promise (>=11.0.0, <=11.5.4)

pg-promise NPM version =11.0.0, =0.0.1, =1.0.1, =1.2.1, =6.1.0-alpha.7, =2.4.46, =1.0.1, =0.29.0, =6.1.0-alpha.3, =2.0.0, =2.0.1 Source cves: CVE-2025-29744 Source advisory: GHSA-FF9H-848C-4XFJ...

GHSA-FF9H-848C-4XFJ pg-promise SQL Injection vulnerability

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

218-tapp-admin (1.0.0), @0x18b2ee/parse-server (>=3.10.1, <=3.11.0) +581 more potentially affected by CVE-2025-29744 via pg-promise (>=0.9.8, <=11.5.4)

pg-promise NPM version =0.9.8, =3.10.1, =0.0.1, =2.0.0, =0.0.2, =0.0.3, =2.1.0, =0.2.0, =0.1.0, =2.1.0, =9.3.8, =0.16.0, =2.13.15-replace-jellyfish-uuid-aac8d5b22ba8bad477ef1998df13b18ab4a4e1da, =2.0.0-update-logger-and-core-34afc83b38698466e0f0fdc49b74072294d1f332,...

CVE-2025-29744: Improper Neutralization of Special Elements used in an SQL Command

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

pg-promise security vulnerabilities

pg-promise is a PostgreSQL interface for Node.js by Vitaly Tomilov Personal Developer. A security vulnerability exists in pg-promise versions prior to 11.5.5, which stems from mishandling of negative numbers and may lead to SQL injection...

CVE-2025-29744

The pg-promise library (NPM) versions prior to 11.5.5 are vulnerable to SQL Injection due to the improper handling of negative numbers. This flaw allows an attacker to manipulate SQL queries by injecting malicious input. Several packages, including parse-server , class-controller , and @evdhiggin...

PT-2025-25330 · Unknown · Pg-Promise

Name of the Vulnerable Software and Affected Versions: pg-promise versions prior to 11.5.5 Description: The issue is related to SQL Injection due to improper handling of negative numbers. Recommendations: For versions prior to 11.5.5, update to version 11.5.5 or later to resolve the issue...

@arpinum/postgres (>=4.0.0-beta12, <=4.0.0-beta14), appointmed-epr-template-common (>=0.0.46, <=0.0.65) +9 more potentially affected by CVE-2017-16082 via pg (>=6.2.2, <=6.2.3)

pg NPM version =6.2.2, =4.0.0-beta12, =0.0.46, =0.0.35, =0.13.3, =0.0.1, =0.0.1, =1.0.0, =1.0.3 - pg-promise-strict 0.3.4 - pgo 0.2.1 Source cves: CVE-2017-16082 Source advisory: MEND:CVE-2017-16082...