Threats affecting pkg:golang/NginxPulse

NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint via the id and locationType parameters. This flaw allows remote attackers to manipulate SQL commands, potentially reading database contents and accessing or modifying server files through PostgreSQL superuser functions. The vulnerability is critical with a CVSS 4.0 score of 9.3. A fix is available in version 1.6.26.