tag
Postgresql
pgAdmin 4 Restore Feature Regex-Bypass Command Injection RCE (CVE-2025-13780)
pgAdmin 4's database Restore feature attempts to block dangerous psql meta-commands — which begin with a backslash (\) and can execute arbitrary shell commands via \! — using the regular expression (^|\n)[ \t]\\. This regex only matches a backslash that…
pgAdmin 4 Query Tool Authenticated eval() RCE (CVE-2025-2945)
pgAdmin 4's Query Tool "download" endpoint accepts a querycommited parameter and passes it directly to Python's built-in eval() without any sanitization, allowing an authenticated attacker to run arbitrary Python code under the pgAdmin service account. The…
PostgreSQL pgcrypto PGP Heap Overflow to Superuser Escalation — CVE-2026-2005
The pgcrypto extension's PGP session-key parsing contains a heap-based buffer overflow that corrupts MBuf structure headers used internally to track ciphertext/plaintext buffers. By crafting malicious PGP messages passed to pgcrypto decryption functions, a…
PgBouncer SASL Length Field Integer Overflow Crash — CVE-2026-6664
PgBouncer's mbufgetbytes() bounds check (lib/usual/mbuf.h) computes buf->readpos + len > buf->writepos using 32-bit unsigned arithmetic, which wraps around when a client supplies a very large length value in a SASLInitialResponse ('p') message, silently…
Percona PMM Authenticated RCE via PostgreSQL COPY TO PROGRAM (CVE-2026-25212)
CVE-2026-25212 arises because PMM's internal PostgreSQL user retains SUPERUSER privileges instead of being restricted. An attacker authenticated with only pmm-admin rights can use Grafana's "Add data source" feature to register an arbitrary PostgreSQL data…
Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980
Apache Superset versions before 6.0.0 are vulnerable to an authenticated, error-based SQL injection reachable through the sqlExpression (adhoc column) or extras.where parameters of the /api/v1/chart/data REST endpoint. Superset's validateadhocsubquery()…
PostgreSQL Referential-Integrity Owner-Switched Implicit Cast RCE
This PoC demonstrates that PostgreSQL's referential-integrity (RI) enforcement for foreign keys switches its effective role to the referenced table's owner before invoking any implicit cast needed to compare the foreign-key value against the primary-key type.…
Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar (CVE-2026-20253)
CVE-2026-20253 is a critical unauthenticated RCE vulnerability in Splunk Enterprise arising from a missing authentication check on the PostgreSQL sidecar service endpoint /v1/postgres/recovery/backup. An unauthenticated attacker can reach this endpoint and…
Drupal Core PostgreSQL SQL Injection (CVE-2026-9082)
CVE-2026-9082 is an unauthenticated SQL injection in Drupal Core's PostgreSQL entity-query handling for JSON:API filters. User-controlled array keys are used to build SQL placeholder names without proper sanitization, enabling injection into generated SQL. On…