BlackTreeCVE Intelligence
← Back to the CVE catalogue
Full vulnerability report · 2025
CVE-2025-1094High confidence

PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

Unknown · PostgreSQL

8.1HighCVSS 3.1
Recommended action
Within 7 days

High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.

Fix not verified
R
Operational reassessment

Published severity in operational context

Open reassessment dashboard →
Published severityHighOperational priority:Critical, raised one band.upgradedsince 14 Mar 2025

Evidence used

  • No CISA KEV confirmation is currently recorded.
  • A structured source references public exploit or proof-of-concept material.
  • The selected CVSS metric records a network-reachable, unauthenticated path with no user interaction.
  • EPSS is 90.03% for the current model date.

Compensating controls

  • Restrict the affected network interface to trusted sources where business-safe.
  • Increase monitoring for the attack path and post-exploitation behaviour described in the report.

Verification

  1. Confirm that the asset runs Unknown PostgreSQL and falls inside the recorded affected range.
  2. Recheck the vendor advisory before scheduling a change because no verified fixed version is currently retained.
  3. Validate exposure, authentication requirements and compensating controls in the actual environment.
  4. Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Mitigation target: Within 3 daysRemediation target: Within 90 days

This automated reassessment organises public evidence. It does not know asset exposure, business impact or control effectiveness and does not replace CVSS or a human risk decision.

Distribution package intelligence

Release-specific package status

Alpine, Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.

11 package states
Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Distribution releaseSource packageVendor stateFixed versionEvidence
Alpine v3.23v3.23 · communitypostgresql16Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.16.8-r0Alpine Security Database ↗Source updated 11 Sep 2026
Alpine v3.23v3.23 · mainpostgresql17Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.17.4-r0Alpine Security Database ↗Source updated 3 Oct 2026
Alpine v3.22v3.22 · communitypostgresql15Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.15.11-r0Alpine Security Database ↗Source updated 11 Sep 2026
Alpine v3.22v3.22 · mainpostgresql16Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.16.8-r0Alpine Security Database ↗Source updated 3 Oct 2026
Alpine v3.22v3.22 · mainpostgresql17Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.17.4-r0Alpine Security Database ↗Source updated 3 Oct 2026
Alpine v3.21v3.21 · communitypostgresql15Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.15.11-r0Alpine Security Database ↗Source updated 19 Aug 2026
Alpine v3.21v3.21 · mainpostgresql16Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.16.8-r0Alpine Security Database ↗Source updated 3 Oct 2026
Alpine v3.21v3.21 · mainpostgresql17Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected.17.4-r0Alpine Security Database ↗Source updated 3 Oct 2026
Debian trixietrixie · sourcepostgresql-17Vendor fix publishedDebian records a fixed source-package version for this release.17.3-1Debian Security Tracker ↗Source updated 5 Oct 2026
Debian bookwormbookworm · sourcepostgresql-15Vendor fix publishedDebian records a fixed source-package version for this release.15.11-0+deb12u1Debian Security Tracker ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archivepostgresql-16Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree.16.8-0ubuntu0.24.04.1Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Choose official national sources for this report. Each advisory shows its original language. Your selection is remembered on this device and included in shared links.

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current
ENISA EUVD identifier

EUVD-2025-1999

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state
Present in the current official mapping
Known exploitation
Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score
Not supplied in the stored EUVD record
Advisory evidence
No linked advisory details stored yet
Recommended actionWithin 7 days

High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.

Fix not verified
01

What, why and how

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

What

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

Why

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

Why

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
Reference recorded

CISA Vulnrichment records proof-of-concept exploitation in its SSVC data. BlackTree has not independently executed or validated exploit material.

Likely attack path
a network path → Improper Neutralization of Quoting Syntax → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface
Network
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
High: exploitation depends on specific conditions
Security boundary
Unchanged: impact remains within the vulnerable component's security authority
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-149 ↗

CWE-149: Improper Neutralization of Quoting Syntax. Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.

AVNetworkAttack vector: The vulnerable component can be reached over a network.ACHighAttack complexity: Successful exploitation depends on specific conditions outside the attacker's direct control.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land
No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
NetworkUnauthenticatedCWE-149Public exploit reference
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

BSI · German · WID-SEC-2025-0372PostgreSQL: Schwachstelle ermöglicht SQL Injection und Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PostgreSQL ausnutzen, um eine SQL Injection durchzuführen und in der Folge beliebigen Programmcode auszuführen.

Official advisory ↗
BSI · German · WID-SEC-2025-1439Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein Angreifer kann mehrere Schwachstellen in Dell Secure Connect Gateway ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Official advisory ↗
Canadian Centre for Cyber Security · English · AV25-084PostgreSQL security advisory (AV25-084)

On February 13, 2025, PostgreSQL published a security advisory to address a vulnerability in the following product: Open-source reporting has advised that CVE-2025-1094 may have been exploited.

Official advisory ↗
Cyber Security Agency of Singapore · English · CSA-SB-20250219Security Bulletin 19 Feb 2025

The Cyber Security Agency of Singapore included this CVE in its official Security Bulletin 19 Feb 2025, published on 19 February 2025. Open the linked bulletin for the product, severity and reference information published in that issue.

Official advisory ↗
CERT-FR · French · CERTFR-2026-AVI-0556Multiples vulnérabilités dans les produits VMware

ve.org/CVERecord?id=CVE-2024-5642 Référence CVE CVE-2024-6119 https://www.cve.org/CVERecord?id=CVE-2024-6119 Référence CVE CVE-2024-6763 https://www.cve.org/CVERecord?id=CVE-2024-6763 Référence CVE CVE-2024-7254 https://www.cve.org/CVERecord?id=CVE-2024-7254 Référence CVE CVE-2024-8184 https://www.cve.org/CVERecord?id=CVE-2024-8184 Référence CVE CVE-2024-9143 https://www.cve.org/CVERecord?id=CVE-2024-9143 Référence CVE CVE-2024-9823 https://www.cve.org/CVERecord?id=CVE-2024-9823 Référence CVE CVE-2025-0938 https://www.cve.org/CVERecord?id=CVE-2025-0938 Référence CVE CVE-2025-10158 https://www.cve.org/CVERecord?id=CVE-2025-10158 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-11143 https://www.cve.org/CVERecord?id=CVE-2025-11143 Référence CVE CVE-2025-11226 https://www.cve.org/CVERecord?id=CVE-2025-11226 Référence CVE CVE-2025-11468 https://www.cve.org/CVERecord?id=CVE-2025-11468 Référence CVE CVE-2025-1194 https://www.cve.org/CVERecord?id=CVE-2025-1194 Référence CVE CVE-2025-12084 https://www.cve.org/CVERecord?id=CVE-2025-12084 Référence CVE CVE-2025-12817 https://www.cve.org/CVERecord?id=CVE-2025-12817 Référence CVE CVE-2025-12818 https://www.cve.org/CVERecord?id=CVE-2025-12818 Référence CVE CVE-2025-13462 https://www.cve.org/CVERecord?id=CVE

Official advisory ↗
CERT-FR · French · CERTFR-2026-AVI-0218Multiples vulnérabilités dans les produits VMware

.org/CVERecord?id=CVE-2025-0167 Référence CVE CVE-2025-0395 https://www.cve.org/CVERecord?id=CVE-2025-0395 Référence CVE CVE-2025-0665 https://www.cve.org/CVERecord?id=CVE-2025-0665 Référence CVE CVE-2025-0725 https://www.cve.org/CVERecord?id=CVE-2025-0725 Référence CVE CVE-2025-0840 https://www.cve.org/CVERecord?id=CVE-2025-0840 Référence CVE CVE-2025-0913 https://www.cve.org/CVERecord?id=CVE-2025-0913 Référence CVE CVE-2025-0938 https://www.cve.org/CVERecord?id=CVE-2025-0938 Référence CVE CVE-2025-10148 https://www.cve.org/CVERecord?id=CVE-2025-10148 Référence CVE CVE-2025-10911 https://www.cve.org/CVERecord?id=CVE-2025-10911 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-10966 https://www.cve.org/CVERecord?id=CVE-2025-10966 Référence CVE CVE-2025-11065 https://www.cve.org/CVERecord?id=CVE-2025-11065 Référence CVE CVE-2025-11081 https://www.cve.org/CVERecord?id=CVE-2025-11081 Référence CVE CVE-2025-11082 https://www.cve.org/CVERecord?id=CVE-2025-11082 Référence CVE CVE-2025-11083 https://www.cve.org/CVERecord?id=CVE-2025-11083 Référence CVE CVE-2025-11412 https://www.cve.org/CVERecord?id=CVE-2025-11412 Référence CVE CVE-2025-11414 https://www.cve.org/CVERecord?id=CVE-2025-11414 Référence CVE CVE-2025-11468 https://www.cve.org/CVERecord?id=C

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0969Multiples vulnérabilités dans les produits VMware

.org/CVERecord?id=CVE-2025-0167 Référence CVE CVE-2025-0306 https://www.cve.org/CVERecord?id=CVE-2025-0306 Référence CVE CVE-2025-0395 https://www.cve.org/CVERecord?id=CVE-2025-0395 Référence CVE CVE-2025-0725 https://www.cve.org/CVERecord?id=CVE-2025-0725 Référence CVE CVE-2025-0838 https://www.cve.org/CVERecord?id=CVE-2025-0838 Référence CVE CVE-2025-0913 https://www.cve.org/CVERecord?id=CVE-2025-0913 Référence CVE CVE-2025-0938 https://www.cve.org/CVERecord?id=CVE-2025-0938 Référence CVE CVE-2025-10148 https://www.cve.org/CVERecord?id=CVE-2025-10148 Référence CVE CVE-2025-10911 https://www.cve.org/CVERecord?id=CVE-2025-10911 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-11226 https://www.cve.org/CVERecord?id=CVE-2025-11226 Référence CVE CVE-2025-11411 https://www.cve.org/CVERecord?id=CVE-2025-11411 Référence CVE CVE-2025-11731 https://www.cve.org/CVERecord?id=CVE-2025-11731 Référence CVE CVE-2025-1215 https://www.cve.org/CVERecord?id=CVE-2025-1215 Référence CVE CVE-2025-12380 https://www.cve.org/CVERecord?id=CVE-2025-12380 Référence CVE CVE-2025-1352 https://www.cve.org/CVERecord?id=CVE-2025-1352 Référence CVE CVE-2025-1365 https://www.cve.org/CVERecord?id=CVE-2025-1365 Référence CVE CVE-2025-1371 https://www.cve.org/CVERecord?id=CVE-2025

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0967Multiples vulnérabilités dans les produits VMware

.cve.org/CVERecord?id=CVE-2024-6505 Référence CVE CVE-2024-6923 https://www.cve.org/CVERecord?id=CVE-2024-6923 Référence CVE CVE-2024-7409 https://www.cve.org/CVERecord?id=CVE-2024-7409 Référence CVE CVE-2024-7592 https://www.cve.org/CVERecord?id=CVE-2024-7592 Référence CVE CVE-2024-8088 https://www.cve.org/CVERecord?id=CVE-2024-8088 Référence CVE CVE-2024-8244 https://www.cve.org/CVERecord?id=CVE-2024-8244 Référence CVE CVE-2024-9287 https://www.cve.org/CVERecord?id=CVE-2024-9287 Référence CVE CVE-2025-0913 https://www.cve.org/CVERecord?id=CVE-2025-0913 Référence CVE CVE-2025-0938 https://www.cve.org/CVERecord?id=CVE-2025-0938 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-1795 https://www.cve.org/CVERecord?id=CVE-2025-1795 Référence CVE CVE-2025-21502 https://www.cve.org/CVERecord?id=CVE-2025-21502 Référence CVE CVE-2025-21574 https://www.cve.org/CVERecord?id=CVE-2025-21574 Référence CVE CVE-2025-21575 https://www.cve.org/CVERecord?id=CVE-2025-21575 Référence CVE CVE-2025-21577 https://www.cve.org/CVERecord?id=CVE-2025-21577 Référence CVE CVE-2025-21579 https://www.cve.org/CVERecord?id=CVE-2025-21579 Référence CVE CVE-2025-21580 https://www.cve.org/CVERecord?id=CVE-2025-21580 Référence CVE CVE-2025-21581 https://www.cve.org/CVERecord?id=CVE

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0580Multiples vulnérabilités dans VMware Tanzu

De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0538Multiples vulnérabilités dans VMware Tanzu

/CVERecord?id=CVE-2024-5206 Référence CVE CVE-2024-52304 https://www.cve.org/CVERecord?id=CVE-2024-52304 Référence CVE CVE-2024-53899 https://www.cve.org/CVERecord?id=CVE-2024-53899 Référence CVE CVE-2024-5569 https://www.cve.org/CVERecord?id=CVE-2024-5569 Référence CVE CVE-2024-56201 https://www.cve.org/CVERecord?id=CVE-2024-56201 Référence CVE CVE-2024-56326 https://www.cve.org/CVERecord?id=CVE-2024-56326 Référence CVE CVE-2024-5998 https://www.cve.org/CVERecord?id=CVE-2024-5998 Référence CVE CVE-2024-7804 https://www.cve.org/CVERecord?id=CVE-2024-7804 Référence CVE CVE-2024-8309 https://www.cve.org/CVERecord?id=CVE-2024-8309 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-30204 https://www.cve.org/CVERecord?id=CVE-2025-30204 Référence CVE CVE-2025-4207 https://www.cve.org/CVERecord?id=CVE-2025-4207 Gestion détaillée du document le 26 juin 2025 Version initiale Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos Contact cyber.gouv.fr service-public.fr legifrance.gouv.fr info.gouv.fr france.fr info.gouv.fr/risques Premier Ministre / Secrétariat Général de la Défense et de la Sécurité Nationale / Agence nationale de la sécurité des systèmes d'information

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0524Multiples vulnérabilités dans VMware Tanzu

.cve.org/CVERecord?id=CVE-2024-6119 Référence CVE CVE-2024-6716 https://www.cve.org/CVERecord?id=CVE-2024-6716 Référence CVE CVE-2024-7348 https://www.cve.org/CVERecord?id=CVE-2024-7348 Référence CVE CVE-2024-8176 https://www.cve.org/CVERecord?id=CVE-2024-8176 Référence CVE CVE-2024-9143 https://www.cve.org/CVERecord?id=CVE-2024-9143 Référence CVE CVE-2024-9287 https://www.cve.org/CVERecord?id=CVE-2024-9287 Référence CVE CVE-2025-0167 https://www.cve.org/CVERecord?id=CVE-2025-0167 Référence CVE CVE-2025-0395 https://www.cve.org/CVERecord?id=CVE-2025-0395 Référence CVE CVE-2025-0938 https://www.cve.org/CVERecord?id=CVE-2025-0938 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-1390 https://www.cve.org/CVERecord?id=CVE-2025-1390 Référence CVE CVE-2025-21490 https://www.cve.org/CVERecord?id=CVE-2025-21490 Référence CVE CVE-2025-21491 https://www.cve.org/CVERecord?id=CVE-2025-21491 Référence CVE CVE-2025-21497 https://www.cve.org/CVERecord?id=CVE-2025-21497 Référence CVE CVE-2025-21500 https://www.cve.org/CVERecord?id=CVE-2025-21500 Référence CVE CVE-2025-21501 https://www.cve.org/CVERecord?id=CVE-2025-21501 Référence CVE CVE-2025-21503 https://www.cve.org/CVERecord?id=CVE-2025-21503 Référence CVE CVE-2025-21505 https://www.cve.org/CVERecord?id=CVE

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0401Multiples vulnérabilités dans Juniper Networks Secure Analytics

CVERecord?id=CVE-2024-56326 Référence CVE CVE-2024-56337 https://www.cve.org/CVERecord?id=CVE-2024-56337 Référence CVE CVE-2024-56463 https://www.cve.org/CVERecord?id=CVE-2024-56463 Référence CVE CVE-2024-57807 https://www.cve.org/CVERecord?id=CVE-2024-57807 Référence CVE CVE-2024-57979 https://www.cve.org/CVERecord?id=CVE-2024-57979 Référence CVE CVE-2024-7348 https://www.cve.org/CVERecord?id=CVE-2024-7348 Référence CVE CVE-2024-8508 https://www.cve.org/CVERecord?id=CVE-2024-8508 Référence CVE CVE-2024-9823 https://www.cve.org/CVERecord?id=CVE-2024-9823 Référence CVE CVE-2025-0624 https://www.cve.org/CVERecord?id=CVE-2025-0624 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-1244 https://www.cve.org/CVERecord?id=CVE-2025-1244 Référence CVE CVE-2025-21785 https://www.cve.org/CVERecord?id=CVE-2025-21785 Référence CVE CVE-2025-24813 https://www.cve.org/CVERecord?id=CVE-2025-24813 Référence CVE CVE-2025-24928 https://www.cve.org/CVERecord?id=CVE-2025-24928 Référence CVE CVE-2025-27363 https://www.cve.org/CVERecord?id=CVE-2025-27363 Référence CVE CVE-2025-27516 https://www.cve.org/CVERecord?id=CVE-2025-27516 Gestion détaillée du document le 14 mai 2025 Version initiale le 30 mai 2025 Ajouts des identifiants CVE CVE-2017-9047, CVE-2021-37533, CVE-20

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0353Multiples vulnérabilités dans les produits VMware

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un problème de sécurité non spécifié par l'éditeur.

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0338Vulnérabilité dans Tenable Security Center

Une vulnérabilité a été découverte dans Tenable Security Center. Elle permet à un attaquant de provoquer une injection SQL (SQLi).

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0337Multiples vulnérabilités dans les produits IBM

g/CVERecord?id=CVE-2024-55565 Référence CVE CVE-2024-56201 https://www.cve.org/CVERecord?id=CVE-2024-56201 Référence CVE CVE-2024-56326 https://www.cve.org/CVERecord?id=CVE-2024-56326 Référence CVE CVE-2024-57699 https://www.cve.org/CVERecord?id=CVE-2024-57699 Référence CVE CVE-2024-6119 https://www.cve.org/CVERecord?id=CVE-2024-6119 Référence CVE CVE-2024-6531 https://www.cve.org/CVERecord?id=CVE-2024-6531 Référence CVE CVE-2024-6763 https://www.cve.org/CVERecord?id=CVE-2024-6763 Référence CVE CVE-2024-7254 https://www.cve.org/CVERecord?id=CVE-2024-7254 Référence CVE CVE-2024-8184 https://www.cve.org/CVERecord?id=CVE-2024-8184 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-1302 https://www.cve.org/CVERecord?id=CVE-2025-1302 Référence CVE CVE-2025-21502 https://www.cve.org/CVERecord?id=CVE-2025-21502 Référence CVE CVE-2025-21613 https://www.cve.org/CVERecord?id=CVE-2025-21613 Référence CVE CVE-2025-21614 https://www.cve.org/CVERecord?id=CVE-2025-21614 Référence CVE CVE-2025-22866 https://www.cve.org/CVERecord?id=CVE-2025-22866 Référence CVE CVE-2025-24970 https://www.cve.org/CVERecord?id=CVE-2025-24970 Référence CVE CVE-2025-25193 https://www.cve.org/CVERecord?id=CVE-2025-25193 Référence CVE CVE-2025-26791 https://www.cve.org/CVERecord?id=CVE

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0283Multiples vulnérabilités dans VMware Tanzu Greenplum

ord?id=CVE-2024-34156 Référence CVE CVE-2024-34158 https://www.cve.org/CVERecord?id=CVE-2024-34158 Référence CVE CVE-2024-3596 https://www.cve.org/CVERecord?id=CVE-2024-3596 Référence CVE CVE-2024-45336 https://www.cve.org/CVERecord?id=CVE-2024-45336 Référence CVE CVE-2024-45337 https://www.cve.org/CVERecord?id=CVE-2024-45337 Référence CVE CVE-2024-45338 https://www.cve.org/CVERecord?id=CVE-2024-45338 Référence CVE CVE-2024-45341 https://www.cve.org/CVERecord?id=CVE-2024-45341 Référence CVE CVE-2024-47561 https://www.cve.org/CVERecord?id=CVE-2024-47561 Référence CVE CVE-2024-50379 https://www.cve.org/CVERecord?id=CVE-2024-50379 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-22866 https://www.cve.org/CVERecord?id=CVE-2025-22866 Gestion détaillée du document le 08 avril 2025 Version initiale le 10 avril 2025 Correction d'une erreur dans le résumé Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos Contact cyber.gouv.fr service-public.fr legifrance.gouv.fr info.gouv.fr france.fr info.gouv.fr/risques Premier Ministre / Secrétariat Général de la Défense et de la Sécurité Nationale / Agence nationale de la sécurité des systèmes d'information

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0214Multiples vulnérabilités dans les produits IBM

d?id=CVE-2024-27306 Référence CVE CVE-2024-45296 https://www.cve.org/CVERecord?id=CVE-2024-45296 Référence CVE CVE-2024-45338 https://www.cve.org/CVERecord?id=CVE-2024-45338 Référence CVE CVE-2024-45638 https://www.cve.org/CVERecord?id=CVE-2024-45638 Référence CVE CVE-2024-45643 https://www.cve.org/CVERecord?id=CVE-2024-45643 Référence CVE CVE-2024-47535 https://www.cve.org/CVERecord?id=CVE-2024-47535 Référence CVE CVE-2024-51744 https://www.cve.org/CVERecord?id=CVE-2024-51744 Référence CVE CVE-2024-52798 https://www.cve.org/CVERecord?id=CVE-2024-52798 Référence CVE CVE-2024-53104 https://www.cve.org/CVERecord?id=CVE-2024-53104 Référence CVE CVE-2025-1094 https://www.cve.org/CVERecord?id=CVE-2025-1094 Référence CVE CVE-2025-1244 https://www.cve.org/CVERecord?id=CVE-2025-1244 Référence CVE CVE-2025-22150 https://www.cve.org/CVERecord?id=CVE-2025-22150 Référence CVE CVE-2025-24970 https://www.cve.org/CVERecord?id=CVE-2025-24970 Référence CVE CVE-2025-25193 https://www.cve.org/CVERecord?id=CVE-2025-25193 Gestion détaillée du document le 14 mars 2025 Version initiale Alertes Avis Bulletins d’actualités Mentions légales Conditions générales À propos Contact cyber.gouv.fr service-public.fr legifrance.gouv.fr info.gouv.fr france.fr info.gouv.fr/risques Premier Ministre / Secrétariat Général de la Dé

Official advisory ↗
CERT-FR · French · CERTFR-2025-AVI-0130Vulnérabilité dans PostgreSQL

Une vulnérabilité a été découverte dans PostgreSQL. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Official advisory ↗
KISA KrCERT/CC · Korean · KNVD-6397PostgreSQL 제품 이용 주의 권고

PostgreSQL quoting API에서 발생하는 SQL Injection 취약점(CVE-2025-1094) [1][2]

Official advisory ↗
KISA KrCERT/CC · Korean · KNVD-6395PostgreSQL 제품 보안 업데이트 권고

PostgreSQL quoting API에서 발생하는 SQL Injection 취약점(CVE-2025-1094) [1][2]

Official advisory ↗
NCSC-NL · Dutch · NCSC-2025-0063Kwetsbaarheid verholpen in PostgreSQL

De kwetsbaarheid bevindt zich in de libpq-functies van PostgreSQL en betreft een SQL-injectiefout. Onjuiste verwerking van aanhalingstekens en verkeerd gevormde UTF-8-sequenties kan leiden tot willekeurige code-executie. Deze kwetsbaarheid wordt actief misbruikt in aanvallen gericht op klanten van BeyondTrust.

Official advisory ↗
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Fix not verified
Affected
PostgreSQL: 17 < 17.3, 16 < 16.7, 15 < 15.11, 14 < 14.16, < 13.19
Fixed
No fixed version is explicitly recorded in the structured CVE data.
Action
No verified patch reference is present in the current structured sources. Check the vendor advisory before making a change.
Workaround
No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04

Evidence and provenance

Published 13 Feb 2025 · Last source change 14 Mar 2025, 03:55 UTC · CWE-149 · Improper Neutralization of Quoting Syntax

CVE recordCVE.org · 5.1
CVSS sourceCNA
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-08-14
European sourceENISA EUVD · EUVD-2025-1999
Product sourceCNA
Remediation sourceCVE/CNA references
CWE sourceCNA
NVD statusNVD not scheduled

Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.

Material change intelligence

What changed after publication

View recent updates ↗

No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.

Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
ENISA EUVD · EUVD-2025-1999↗CISA Vulnrichment SSVC evidence↗CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2025-1094 · cve.blacktree.nl