https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:30:39 +0000 https://cve.radiocsirt.org/vuln/cve-2025-46337 <p><strong>Affected:</strong> ADOdb</p> <p>ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.</p> <p><strong>Affected:</strong> ADOdb</p> <p>ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.</p> https://cve.radiocsirt.org/vuln/cve-2025-46337 https://cve.radiocsirt.org/vuln/ghsa-8x27-jwjr-8545 <p><strong>Affected:</strong> Packagist: adodb/adodb-php</p> <p>Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data.</p> <p>Note that the indicated Severity corresponds to a worst-case usage scenario.</p> <p>### Impact PostgreSQL drivers (postgres64, postgres7, postgres8, postgres9).</p> <p>### Patches Vulnerability is fixed in ADOdb 5.22.9 (11107d6d6e5160b62e05dff8a3a2678cf0e3a426).</p> <p>### Workarounds Only pass controlled data to pg_insert_id() method&#39;s $fieldname parameter, or escape it with pg_escape_identifier() first.</p> <p>### References - Issue https://github.com/ADOdb/ADOdb/issues/1070 - [Blog post](https://xaliom.blogspot.com/2025/05/from-sast-to-cve-2025-46337.html) by Marco Nappi</p> <p>### Credits Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.</p> <p><strong>Affected:</strong> Packagist: adodb/adodb-php</p> <p>Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data.</p> <p>Note that the indicated Severity corresponds to a worst-case usage scenario.</p> <p>### Impact PostgreSQL drivers (postgres64, postgres7, postgres8, postgres9).</p> <p>### Patches Vulnerability is fixed in ADOdb 5.22.9 (11107d6d6e5160b62e05dff8a3a2678cf0e3a426).</p> <p>### Workarounds Only pass controlled data to pg_insert_id() method&#39;s $fieldname parameter, or escape it with pg_escape_identifier() first.</p> <p>### References - Issue https://github.com/ADOdb/ADOdb/issues/1070 - [Blog post](https://xaliom.blogspot.com/2025/05/from-sast-to-cve-2025-46337.html) by Marco Nappi</p> <p>### Credits Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-8x27-jwjr-8545