7.5
Élevée
CVE-2026-120062 SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping…
Description
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| psqlODBC 18.00 | premières → < 18.00.0006 | 18.00.0006 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de psqlODBC
Les 12 CVE de psqlODBC →
CVE-2026-120067
For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to…
5.9
Moyenne
CVE-2026-120066
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program…
5.3
Moyenne
CVE-2026-120065
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to…
7.1
Élevée
CVE-2026-120064
Several psqlODBC entry points use an application-supplied column number or row index as an array index without…
7.5
Élevée