Vulnerabilities

Filters

1 selected

6 records

Sort

Vendor: andialbrecht Clear all filters

TI-2026-76501 CVE-2026-112307 · GHSA-457h-p88w-wq8p

PHP code injection in sqlparse via output_format='php'

LOW 37

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00142 Published 2026-10-19 No fix listed CWE-94

TI-2026-57940 CVE-2026-84305 · GHSA-cfqr-cjx5-5jcm

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

MEDIUM 56

sqlparse is a non-validating SQL parser module for Python.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00189 Published 2026-09-01 Partial fix · 0.6.0 CWE-407

TI-2026-39184 CVE-2026-54284 · GHSA-pwgv-4x5q-6m9f

sqlparse: TokenList.init materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

HIGH 77

sqlparse is a non-validating SQL parser module for Python.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00332 Published 2026-08-17 Partial fix · 0.6.0 CWE-1333

TI-2026-42707 CVE-2026-59893 · GHSA-prg7-hcfm-mfcr

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

HIGH 72

sqlparse is a non-validating SQL parser module for Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00337 Published 2026-08-17 Partial fix · 0.6.0 CWE-1333

TI-2026-50099 CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p

sqlparse: Quadratic O(n²) DoS in group_comments

MEDIUM 43

sqlparse is a non-validating SQL parser module for Python.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00263 Published 2026-08-17 Partial fix · 0.6.0 CWE-400

TI-2026-42708 CVE-2026-59894 · GHSA-3496-9g83-7v6x

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

LOW 27

sqlparse is a non-validating SQL parser module for Python.

CVSS 4.0MEDIUM 6.2 Local No auth User interaction EPSS 0.00129 Published 2026-08-17 Partial fix · 0.6.0 CWE-94