postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

Important: Red Hat Security Advisory: postgresql:12 security update

An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.3-12.3 Exécution de code à distance authentifiée Preuve de concept La base de données PostgreSQL, de la version 9.3 à la version 12.3 dernière testée, est vulnérable à l'exécution de code à distance authentifiée. Même si elle n'est pas considérée comme une vulnérabili...

CVE-2018-1058

CVE-2018-1058 — Démonstration du Search Path de PostgreSQL Ce dépôt contient le rapport final et les artefacts de reproductibilité pour : CVE-2018-1058 : Élévation de privilèges dans PostgreSQL via un Search Path non contrôlé L'objectif est de démontrer l'échec de confiance du search path à...

CVE-2020-7471

CVE-2020-7471 Ce dépôt fournit l'environnement et le POC pour la vulnérabilité CVE-2020-7471 Potential SQL injection via StringAggdelimiter. Versions de Django affectées 1.11 à 1.11.28 exclu 2.2 à 2.2.10 exclu 3.0 à 3.0.3 exclu Opérations requises avant le téléchargement et l'utilisation : 1...

CVE-2026-107315

A flaw was found in the PostgreSQL JDBC Driver pgjdbc. When an application transmits a value shorter than its declared length, the driver pads the remaining data with residual bytes from its internal send buffer instead of zero bytes. An attacker who can induce the application to store and...

CVE-2026-107314

A flaw was found in the PostgreSQL JDBC Driver pgjdbc, which may lead to information disclosure. When the requireAuth connection property is configured to exclude all supported authentication mechanisms or lacks a valid method, the driver fails to enforce authentication restrictions and accepts a...

poc_cve-2026-42208

CVE-2026-42208 — Injection SQL pré-authentification LiteLLM Un environnement de laboratoire pour reproduire et détecter CVE-2026-42208 , une injection SQL critique avant authentification dans LiteLLM où des jetons Bearer non nettoyés atteignent une requête PostgreSQL brute. Aperçu de la...

CVE-2019-9193-Postgresql-RCE

usage : CVE-2019-9193.py -h -i IP -p PORT -d DATABASE -c COMMAND -t TIMEOUT -U USER -P PASSWORD exemple : python3 CVE-2019-9193.py -i 127.0.0.1 -p 5432 -U postgres -c 'id' exemple 2 : python3 CVE-2019-9193.py -h localhost -p 5432 -U postgres -c 'id' sortie : + Connexion à la base de données...

heartbleeder

Heartbleeder Teste vos serveurs pour OpenSSL CVE-2014-0160, également connu sous le nom de Heartbleed. AVERTISSEMENT : Aucune garantie n'est fournie quant à l'exactitude des résultats, et vous devez les vérifier indépendamment en contrôlant votre build OpenSSL. Les pull requests sont les...

CVE-2026-9082

Scanner Drupal CVE-2026-9082 Scanner semi-passif qui détecte les installations Drupal potentiellement vulnérables à la CVE-2026-9082 injection SQL PostgreSQL. Aucune charge utile SQL envoyée. Aucune requête modifiant l'état. Versions vulnérables Branche| Versions affectées| Version corrigée...

POC-CVE-2025-1094

POC CVE-2025-1094: PostgreSQL psql SQL Injection Proof of Concept pour la vulnérabilité d'injection SQL critique dans le client PostgreSQL libpq et l'outil psql 📋 Table des matières 1. Introduction à la vulnérabilité 2. Structure du répertoire du projet 3. Analyse du payload d'attaque 4. Guide...

CLEANSTART-2026-DW89349 pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Security vulnerability affects the apache-hive package. pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE...

CVE-2026-107315

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

DEBIAN-CVE-2026-107315

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

DEBIAN-CVE-2026-107314

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method...

CVE-2026-107314

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method...

CVE-2026-107315

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

EUVD-2026-94650

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

CVE-2026-107315

The pgjdbc (PostgreSQL JDBC Driver) versions 42.7.4 through 42.7.13 are vulnerable to an information disclosure issue where values shorter than their declared length are padded with leftover bytes from the send buffer instead of zeros. This buffer contains fragments of previous messages, includin...