CVE-2026-112306

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

EUVD-2026-104398

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112306

The NocoBase @nocobase/plugin-collection-sql component, version 2.2.28 and below , is vulnerable to an SQL injection flaw. The root cause is the ability for privileged users to bypass the checkSQL() validation via the sqlCollection:setFields action. This allows an attacker with the collection-sql...

CVE-2026-112306 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

GHSA-V8VM-CQH8-Q87Q NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete...

Dump PostgreSQL Role Password Hashes

Dump role password hashes from pgauthid/pgshadow superuser. Supports SCRAM-SHA-256 and legacy MD5 hashes for offline cracking from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Dump PostgreSQL Role...

Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords

Greetings, There appears to be some deficiencies in both the documentation of the 'md5' authentication methology in pghba.conf and in the md5 hash generation which is stored in pgshadow. The md5 hash which is generated for and stored in pgshadow does not use a random salt but instead uses the...

CVE-2000-1199: Undefined Security Weakness

PostgreSQL stores usernames and passwords in plaintext in 1 pgshadow and 2 pgpwd, which allows attackers with sufficient privileges to gain access to databases...

Postgresql cleartext password storage

Hi, While migrating some postgres databases to a different server including user accounts i noticed the following problem in the way postgres stores user passwords: SmellyCat:/var/postgres/data strings pgshadow someaccountname someaccountpassword anotheraccountname anotheraccountpassword...

PostgreSQL 6.3.2/6.5.3 - Cleartext Passwords

source: https://www.securityfocus.com/bid/1139/info PostgreSQL is a free RDBMS that is released under a Berkeley style license. PostgreSQL stores passwords for database users in a binary file called pgshadow. This file is readable by root and the postgres user. Unfortunately, these passwords are...

PostgreSQL 6.3.26.5.3 - Cleartext Passwords

PostgreSQL 6.3.26.5.3 - Cleartext Passwords source: https://www.securityfocus.com/bid/1139/info PostgreSQL is a free RDBMS that is released under a Berkeley style license. PostgreSQL stores passwords for database users in a binary file called pgshadow. This file is readable by root and the postgr...