CVE-2020-7471-Django

CVE-2020-7471-PoC Django PoC для уязвимости SQL-инъекции в PostgreSQL с Django, обнаруженной в Django 1.11 до 1.11.28, 2.2 до 2.2.10 и 3.0 до 3.0.3 Класс django.contrib.postgres.aggregates.StringAgg для использования функции PostgreSQL STRINGAGG имел уязвимость SQL-инъекции. Возможно внедрить...

ALSA-2026:69876 Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

Important: Red Hat Security Advisory: postgresql:15 security update

An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists

A flaw was found in PostgreSQL pgdump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

CTF_CVE-2020-7471

DOBBYISFREE! CTF: 2020 Christmas CTF Категория: WEB Ключевое слово: DOBBYISFREE! Сложность: ★★★☆☆ Предыстория Обычно веб-хакеры изучают SQL-инъекции на MySQL, поэтому я решил создать задачу с использованием PostgreSQL, чтобы у них была возможность испытать атаки на разные СУБД. Решение...

CVE-2026-20253

🚨 CVE-2026-20253 - Критическая уязвимость неаутентифицированного создания файлов в Splunk Enterprise Уязвимость неаутентифицированного создания и усечения произвольных файлов, затрагивающая Splunk Enterprise и Splunk Cloud Platform. 📖 Краткое описание CVE-2026-20253 — это критическая уязвимость в...

cve_manager

Описание проекта Набор приложений Python и shell-скриптов для отправки по электронной почте xlsx-таблицы новых уязвимостей из базы данных NIST CVE и связанных с ними продуктов по ежедневному расписанию. Затем таблицу можно вручную интерпретировать для оценки рисков для вашей конкретной организаци...

CVE-2025-1094

Я написал этот эксплойт, ссылаясь на PoC, доступный по адресу CVE-2025-1094 CVE‑2025‑1094 | Уязвимость санитизации ввода в PostgreSQL Обзор CVE‑2025‑1094 — это уязвимость санитизации ввода в escape-функциях libpq PostgreSQL и интерактивном инструменте psql. Она вызвана некорректной обработкой...

CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.6.1 원격 코드 실행 인증됨 개념 증명 PostgreSQL 데이터베이스 9.6.1 버전부터는 인증된 원격 코드 실행Authenticated Remote Code Execution에 취약합니다. 개발 팀이 이를 취약점 자체로 간주하지 않더라도, 잘못 구성된 시스템에 접근 권한을 얻는 데 악용될 수 있습니다. 도움말 메뉴 악용 예시 참고 자료 NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-9193 CVE Details:...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — SQL-инъекция в Drupal на базе PostgreSQL Массовый сканер и инструмент эксплуатации Неаутентифицированная SQL-инъекция в ядре Drupal PostgreSQL Инъекция ключа массива фильтра JSON:API через злоупотребление именами PDO-плейсхолдеров Обзор CVE-2026-9082 — это чрезвычайно критическая...

CVE-2026-20253

CVE-2026-20253 — Лаборатория Pre-Auth RCE для Splunk Enterprise Создание и усечение произвольных файлов без аутентификации через сайдкар PostgreSQL CVSS 9.8 · Критическая · CWE-306 · Активно эксплуатируется CISA KEV ⚠️ Отказ от ответственности Этот репозиторий предназначен строго для...