CVE-2023-26033

Gentoo soko (packages.gentoo.org) is vulnerable to SQL injection in versions prior to 1.0.1, exploitable via the Recently Visited Packages search_history cookie. Attackers can alter the cookie (base64-encoded comma list of atoms) to inject SQL into atom = '%s' queries, potentially wiping or alter...

CVE-2023-28424

CVE-2023-28424 concerns Gentoo Soko, a Go module powering packages.gentoo.org. The vulnerability affects the package search handlers in Go code (pkg/app/handler/packages/search.go) prior to version 1.0.2, where the parameter q enabled a SQL injection. This allowed unauthenticated attackers to run...