CriticalCVSS 9.8
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Product
debian/sqlalchemy vulnerabilities
3 published CVES affecting debian/sqlalchemy, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 3
- Critical
- 1
- High
- 2
- Medium
- 0
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest debian/sqlalchemy CVEs
Newest publication first
-
-
HighCVSS 7.8 EPSS 1.8%
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
-
HighCVSS 7.5
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset f...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.