postgresql Vulnerabilities and Affected Products
Vulnerabilities associated with postgresql_jdbc_driver.
Products
Clear product- postgresql12 vulnerabilities
- pgadmin_43 vulnerabilities
- pgadmin2 vulnerabilities
- postgresql_jdbc_driver2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-1597CRITICAL | pgjdbc SQL Injection via line comment generationpgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized … CWE-89Feb 19, 2024 | CVSS10.0v3.1 | EPSS4.81% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-31197HIGH | SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcPostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user. User applications that do not invoke the `Resul… CWE-89Aug 3, 2022 | CVSS7.1v3.1 | EPSS2.09% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |