pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/vitaly-t/pg-promise/discussions/911 | Exploit Issue Tracking |
| https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/ | Exploit Third Party Advisory |
Configurations
History
02 Jul 2025, 15:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/vitaly-t/pg-promise/discussions/911 - Exploit, Issue Tracking | |
| References | () https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/ - Exploit, Third Party Advisory | |
| First Time |
Vitaly-t pg-promise
Vitaly-t |
|
| CPE | cpe:2.3:a:vitaly-t:pg-promise:*:*:*:*:*:node.js:*:* |
12 Jun 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-12 16:15
Updated : 2025-07-02 15:55
NVD link : CVE-2025-29744
Mitre link : CVE-2025-29744
JSON object : View
Products Affected
vitaly-t
- pg-promise
CWE
No CWE.