[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCKhQU_GFq_IuePiKs4eByQHAFEyrz4NciOV33pghRdA":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":45,"kevVulnerabilities":109,"topProductsByCves":110,"seoMetadata":117,"meta":126},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":44},25324,"postgresql",6,174,0,886,"2025-06-11","p",[16,21,26,32,37,41],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":20},130154,581,165,"2024-11-14",{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":13},130156,"postgresql_jdbc_driver",99,9,{"id":27,"product_name":28,"version_count":29,"cve_count":30,"kev_count":11,"last_cve_update":31},130155,"postgresql-common",120,1,"2019-11-20",{"id":33,"product_name":34,"version_count":35,"cve_count":11,"kev_count":11,"last_cve_update":36},130152,"pgadmin_4",75,null,{"id":38,"product_name":39,"version_count":40,"cve_count":11,"kev_count":11,"last_cve_update":36},130153,"pgjdbc",10,{"id":42,"product_name":43,"version_count":30,"cve_count":11,"kev_count":11,"last_cve_update":36},130157,"psqlodbc","Postgresql is a technology vendor with 6 tracked products and 174 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[46,55,62,70,77,82,87,93,98,103],{"cveId":47,"description":48,"publishedDate":49,"cvssScore":50,"cvssVersion":51,"severity":52,"isKev":53,"epssScore":54},"CVE-2019-9193","In PostgreSQL 9.3 through 11.2, the \"COPY TO\u002FFROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim\u002Fstate this is not an issue because PostgreSQL functionality for ‘COPY TO\u002FFROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.","2019-04-01",7.2,"v3.0","High",false,0.91655,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":51,"severity":60,"isKev":53,"epssScore":61},"CVE-2017-7546","PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.","2017-08-16",9.8,"Critical",0.61566,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":67,"severity":68,"isKev":53,"epssScore":69},"CVE-2013-1899","Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a \"-\" (hyphen).","2013-04-04",6.5,"v2","Medium",0.54312,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":75,"severity":52,"isKev":53,"epssScore":76},"CVE-2020-25695","A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","2020-11-16",8.8,"v3.1",0.4644,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":25,"cvssVersion":67,"severity":60,"isKev":53,"epssScore":81},"CVE-2007-3280","The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.","2007-06-19",0.2549,{"cveId":83,"description":84,"publishedDate":85,"cvssScore":74,"cvssVersion":75,"severity":52,"isKev":53,"epssScore":86},"CVE-2022-1552","A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.","2022-08-31",0.1597,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":91,"cvssVersion":67,"severity":52,"isKev":53,"epssScore":92},"CVE-2005-0245","Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.","2005-02-01",7.5,0.14473,{"cveId":94,"description":95,"publishedDate":96,"cvssScore":66,"cvssVersion":67,"severity":68,"isKev":53,"epssScore":97},"CVE-2010-0442","The bitsubstr function in backend\u002Futils\u002Fadt\u002Fvarbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an \"overflow.\"","2010-02-02",0.13255,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":74,"cvssVersion":75,"severity":52,"isKev":53,"epssScore":102},"CVE-2018-1058","A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.","2018-03-02",0.13098,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":107,"cvssVersion":67,"severity":68,"isKev":53,"epssScore":108},"CVE-2009-0922","PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.","2009-03-17",4,0.10242,[],[111,112,113,114,115,116],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":11,"last_cve_update":13},{"id":27,"product_name":28,"version_count":29,"cve_count":30,"kev_count":11,"last_cve_update":31},{"id":33,"product_name":34,"version_count":35,"cve_count":11,"kev_count":11,"last_cve_update":36},{"id":38,"product_name":39,"version_count":40,"cve_count":11,"kev_count":11,"last_cve_update":36},{"id":42,"product_name":43,"version_count":30,"cve_count":11,"kev_count":11,"last_cve_update":36},{"title":118,"metaDescription":119,"keywords":120,"structuredData":121},"Postgresql - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Postgresql covering 6 products with 174 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Postgresql vulnerabilities, Postgresql security, Postgresql CVE, Postgresql threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":122,"@type":123,"name":124,"description":119,"url":125},"https:\u002F\u002Fschema.org","Organization","Postgresql","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fpostgresql",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":127,"apiVersion":128},"2026-10-17T17:00:31.202Z","3.0"]