JawherKl node-api-postgres vulnerabilities

Latest JawherKl node-api-postgres CVEs

Newest publication first

1. CVE-2026-4191 JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload

   Published 2026-03-15

   Medium·CVSS 6.9

   A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has bee...

2. CVE-2026-4190 JawherKl node-api-postgres user.js User.getAll sql injection

   Published 2026-03-15

   Medium·CVSS 6.9

   A vulnerability was detected in JawherKl node-api-postgres up to 2.5. This impacts the function User.getAll of the file models/user.js. The manipulation of the argument sort results in sql injection. The attack can be executed remotely. The exploit is now public and may be used....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.