PT-2025-25330 · Unknown · Pg-Promise

Name of the Vulnerable Software and Affected Versions: pg-promise versions prior to 11.5.5 Description: The issue is related to SQL Injection due to improper handling of negative numbers. Recommendations: For versions prior to 11.5.5, update to version 11.5.5 or later to resolve the issue...

CVE-2025-29744

CVE-2025-29744 affects pg-promise (Node.js PostgreSQL interface); root cause is improper handling of negative numbers, leading to SQL Injection in versions before 11.5.5. Public documents consistently describe a vulnerability in the query construction/parameter handling that can allow attacker-su...

CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

go-pg pg 安全漏洞

go-pg pg is a go-pg open source ORM for Golang. A security vulnerability exists in go-pg pg version v10.13.0, which stems from an unvalidated /types/appendvalue.go component that could lead to an SQL injection attack...

CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2024-44905

CVE-2024-44905 affects go-pg pg v10.13.0 with an SQL injection flaw in /types/append_value.go. The NVD metrics (CVSS v3.1: 6.5, Network attack vector, no privileges, user interaction required, Confidentiality Impact High) indicate a remote risk if an attacker can trigger the vulnerable code path....

CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2019-15658

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data...

CVE-2009-2882

Multiple cross-site scripting XSS vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 browseladies.php and 2 browsemen.php, the 3 gender parameter to search.php, and the 4 id parameter to services.php...

The vulnerability of the pg-cluster component of the BIG-IP Next Central Manage application programming interface allows a attacker to disclose protected information.

The vulnerability of the pg-cluster component of the BIG-IP Next Central Manage application programming interface is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker to disclose the protected information...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to improper escaping of a query parameter in the postgres64, postgres7, postgres8, and postgres9 drivers. An attacker can execute arbitrary SQL statements by injecting malicious SQL code into the pginsertid method...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, sealed-secrets, bank-vaults, local-static-provisioner, grpcurl, newrelic-nri-statsd, weaviate, clickhouse-operator, sftpgo-plugin-geoipfilter, gitsign, bom, crossplane-provider-aws-s3, fq, kubernetes-dashboard-api, otel-cli,...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam, terraform-provider-time, grafana-pyroscope, etcd, metallb, consul-k8s-fips, k3d, oauth2-proxy-fips, pulumi-language-java, rabbitmq-messaging-topology-operator-fips, aws-network-policy-agent-fips, verticadb-operator, grafana-fips, kots,...

DEBIAN-CVE-2025-22124

In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix wrong bitmaplimit for clustermd when write sb In clustermd, separate write-intent-bitmaps are used for each cluster node: 0 4k 8k 12k ------------------------------------------------------------------- | idle | ...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: redka, kyverno-notation-aws, sealed-secrets, bank-vaults, local-static-provisioner, render-template, grpcurl, newrelic-nri-statsd, docker-cli, esbuild, bom, fq, kubernetes-dashboard-api, cortex, falcoctl, mailpit, fuse-overlayfs-snapshotter, kubeflow-katib,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: redka, kyverno-notation-aws, sealed-secrets, bank-vaults, local-static-provisioner, render-template, grpcurl, newrelic-nri-statsd, docker-cli, esbuild, bom, fq, kubernetes-dashboard-api, cortex, falcoctl, mailpit, fuse-overlayfs-snapshotter, kubeflow-katib,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: aws-flb-cloudwatch-fips, terraform-provider-time, etcd, metallb, consul-k8s-fips, go-bindata, k3d, oauth2-proxy-fips, rabbitmq-messaging-topology-operator-fips, git-sync, aws-network-policy-agent-fips, conftest-fips, grafana-fips, dex-k8s-authenticator, yunikorn-web,...

CVE-2024-56182

CVE-2024-56182 describes a local vulnerability in Siemens SIMATIC/SIEMENS IPC family where EFI variables are insufficiently protected. This could allow an authenticated local attacker to disable the BIOS password by communicating with the flash controller, affecting a wide range of Field PGs, IPC...

CVE-2024-56182

A vulnerability has been identified in SIMATIC Field PG M5 All versions, SIMATIC Field PG M6 All versions V26.01.12, SIMATIC IPC BX-21A All versions V31.01.07, SIMATIC IPC BX-32A All versions V29.01.07, SIMATIC IPC BX-39A All versions V29.01.07, SIMATIC IPC BX-59A All versions V32.01.04, SIMATIC...