Approved changes feed: RSS · Atom
cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Sqlparse Project (43e8fa36-ffb5-55a2-afc7-de403904e167) |
|---|---|
| Product | Sqlparse (ce0f6f0d-81e0-53fe-85e7-076dc2d89776) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/andialbrecht/sqlparse |
purl2cpe | 2026-06-01 10:14:48.484412 |
pkg:golang/github.com/andialbrecht/sqlparse |
purl2cpe | 2026-06-01 10:14:48.484414 |
pkg:pypi/sqlparse |
purl2cpe | 2026-06-01 10:14:48.484416 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-112307 |
vulnerable | 2026-11-03 10:16:28.956829 |
sqlparse through 0.6.0 PHP Code Injection via output_format='php'
HIGH (7.3)
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
Published: 2026-10-19T15:28:57.066Z
Updated: 2026-10-19T16:41:10.929Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4340 |
vulnerable | 2026-06-08 06:50:17.546291 |
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
HIGH (7.5)
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Published: 2024-04-30T14:23:03.435Z
Updated: 2025-11-03T22:05:00.696Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32839 |
vulnerable | 2026-06-08 05:32:08.145548 |
Regular Expression Denial of Service in sqlparse
HIGH (7.5)
sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.
Published: 2021-09-20T17:10:12.000Z
Updated: 2025-11-03T21:44:47.559Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.