https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:17:17 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-10898 bdu:2025-10898 https://cve.radiocsirt.org/vuln/bdu:2025-10898 https://cve.radiocsirt.org/vuln/euvd-2026-252266 EUVD-2026-252266 https://cve.radiocsirt.org/vuln/euvd-2026-252266 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58450 <p>pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such attempts.</p> <p>pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such attempts.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-58450 https://cve.radiocsirt.org/vuln/ghsa-p46v-f2x8-qp98 <p><strong>Affected:</strong> Go: github.com/prest/prest/v2</p> <p># Summary pREST provides a simple way for users to expose access their database via a REST-full API. The project is implemented using the Go programming language and is designed to expose access to Postgres database tables.</p> <p>During an independent review of the project, Doyensec engineers found that SQL injection is a systemic problem in the current implementation (version `v2.0.0-rc2`). Even though there are several instances of attempts to sanitize user input and mitigate injection attempts, we have found that on most code-paths, the protection is faulty or non-existent.</p> <p>## Core Endpoints The main functionality providing REST operations on the data stored in the Postgres database is exposed via the following endpoints: - `GET /{database}/{schema}/{table}` - `POST /{database}/{schema}/{table}` - `PUT|PATCH /{database}/{schema}/{table}` - `DELETE /{database}/{schema}/{table}`</p> <p>Handlers for the above endpoints execute very similar logic. At a high-level they: 1. Perform authentication and authorization 2. Build the SQL query based on the incoming request 3. Execute the query on the database 4. Return the data to the user</p> <p>The query construction logic uses data from the request (e.g query, body or path parameters) and incorporates them in the SQL query.</p> <p>As an example, let us look at the `GET` request or the read operation. After completing the authentication and authorization steps, the `SelectFromTables` function will first compile a list of all columns/fields, that will…</p> <p><strong>Affected:</strong> Go: github.com/prest/prest/v2</p> <p># Summary pREST provides a simple way for users to expose access their database via a REST-full API. The project is implemented using the Go programming language and is designed to expose access to Postgres database tables.</p> <p>During an independent review of the project, Doyensec engineers found that SQL injection is a systemic problem in the current implementation (version `v2.0.0-rc2`). Even though there are several instances of attempts to sanitize user input and mitigate injection attempts, we have found that on most code-paths, the protection is faulty or non-existent.</p> <p>## Core Endpoints The main functionality providing REST operations on the data stored in the Postgres database is exposed via the following endpoints: - `GET /{database}/{schema}/{table}` - `POST /{database}/{schema}/{table}` - `PUT|PATCH /{database}/{schema}/{table}` - `DELETE /{database}/{schema}/{table}`</p> <p>Handlers for the above endpoints execute very similar logic. At a high-level they: 1. Perform authentication and authorization 2. Build the SQL query based on the incoming request 3. Execute the query on the database 4. Return the data to the user</p> <p>The query construction logic uses data from the request (e.g query, body or path parameters) and incorporates them in the SQL query.</p> <p>As an example, let us look at the `GET` request or the read operation. After completing the authentication and authorization steps, the `SelectFromTables` function will first compile a list of all columns/fields, that will…</p> https://cve.radiocsirt.org/vuln/ghsa-p46v-f2x8-qp98 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1 <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1