17189 matches found
PT-2026-68256
Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.1.0 Description An authenticated SQL injection exists in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can exploit this by creating a collection with a...
CVE-2026-10716: Improper Neutralization of Special Elements used in an SQL Command
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...
PT-2026-68149
Name of the Vulnerable Software and Affected Versions Magistrala formerly Mainflux affected versions not specified Description The message-readers API reads a format value from the HTTP query string in readers/api/http/transport.go without validation. This value is interpolated directly into raw...
CVE-2026-71276: Improper Neutralization of Special Elements used in an SQL Command
Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...
PT-2026-67992
Name of the Vulnerable Software and Affected Versions ZTE NX799J Red Magic 11 Air affected versions not specified Description The built-in PostgreSQL service contains misconfiguration flaws and command injection issues. The service operates with root privileges, listens on a specific port, and us...
CVE-2026-49004: Improper Neutralization of Special Elements used in an SQL Command
The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...
LiteLLM 1.83.6 Blind SQL Injection
A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...
Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
📄 LiteLLM 1.83.6 Blind SQL Injection
A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...
Photon OS 5.0: Postgresql13 PHSA-2025-5.0-91-0597
An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0597. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
RHEL 9 : libpq (RHSA-2026:50779)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50779 advisory. The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql:...
Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0597
An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0597. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
RHEL 9 : postgresql (RHSA-2026:50811)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50811 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution...
Photon OS 5.0: Postgresql14 PHSA-2026-5.0-91-0762
An update of the postgresql14 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0762. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Postgresql15 PHSA-2026-5.0-91-0762
An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0762. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
K000162749: PostgreSQL vulnerability CVE-2026-6638
Security Advisory Description SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within...
Important: Red Hat Security Advisory: postgresql security update
An update for postgresql is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module
A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...
