Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-112307

sqlparse through 0.6.0 PHP Code Injection via output_format='php'

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Sqlparse Project
Products
Sqlparse
CVE-2023-30608

Parser contains an inefficient regular expression in sqlparse

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Sqlparse Project
Products
Debian Linux Rhui Satellite and 2 more
CVE-2021-32839

Regular Expression Denial of Service in sqlparse

sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Redhat Sqlparse Project
Products
Satellite Satellite Capsule Sqlparse