PostgreSQL
Approved changes feed: RSS · Atom
cpe:2.3:a:postgresql:postgresql:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Postgresql (17ae1743-f0f5-50ae-b0e9-670248233cae) |
|---|---|
| Product | Postgresql (cce58cf9-95f4-56e0-85d7-e79aa6a78bc7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/postgresql |
purl2cpe | 2026-06-01 10:12:16.852731 |
pkg:deb/ubuntu/postgresql |
purl2cpe | 2026-06-01 10:12:16.852732 |
pkg:docker/postgres |
purl2cpe | 2026-06-01 10:12:16.852733 |
pkg:github/postgres/postgres |
purl2cpe | 2026-06-01 10:12:16.852735 |
pkg:gitlab/redhat/postgresql |
purl2cpe | 2026-06-01 10:12:16.852736 |
pkg:rpm/fedora/postgresql |
purl2cpe | 2026-06-01 10:12:16.852737 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-10979 |
vulnerable | 2026-06-08 06:23:48.342661 |
PostgreSQL PL/Perl environment variable changes execute arbitrary code
HIGH (8.8)
Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
Published: 2024-11-14T13:00:08.586Z
Updated: 2025-11-03T21:51:41.330Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24844 |
not_vulnerable | 2026-06-08 05:41:44.747181 |
SQL Injection in github.com/flipped-aurora/gin-vue-admin
HIGH (8.1)
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
Published: 2022-04-13T21:10:10.000Z
Updated: 2025-04-22T18:15:56.915Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-8806 |
vulnerable | 2026-06-08 05:10:08.924461 |
Details available
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links insecurely, which could result in local denial of service by overwriting arbitrary files.
Published: 2017-11-13T09:00:00.000Z
Updated: 2024-08-05T16:48:21.905Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-4575 |
not_vulnerable | 2026-06-08 05:02:51.562854 |
Details available
The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.
Published: 2012-11-18T19:00:00.000Z
Updated: 2024-08-06T20:42:54.602Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.