TI-2025-01307 CVE-2025-1520 · GHSA-v64v-fq96-c5wv
SQL injection in PostHog
Priority LOW 37
PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability.
PostHog
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
PostHog records in CISA KEVNo PostHog vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2024-09007 CVE-2024-9710 · GHSA-jrwm-4975-3g9g
Server-side request forgery in PostHog
Priority LOW 37
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability.
TI-2025-01309 CVE-2025-1522 · GHSA-55cg-p3v8-2vr3
Server-side request forgery in PostHog
Priority LOW 30
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability.
TI-2025-01308 CVE-2025-1521 · GHSA-8w5j-q5mj-5jpv
Server-side request forgery in PostHog
Priority LOW 30
PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability.
TI-2022-00561 CVE-2022-0645 · GHSA-6xh2-f372-cf5m
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog
Priority LOW 29
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.
TI-2023-15619 CVE-2023-32325 · GHSA-8775-5hwv-wr6v
Cross-site scripting in PostHog-js
Priority LOW 28
PostHog-js is a library to interface with the PostHog analytics tool.
TI-2023-25229 CVE-2023-46746
Authenticated PostHog users vulnerable to SSRF
Priority LOW 22
PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host.