Threats tagged 'ghsa-jqh3-8vc6-rjxr'

NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint. This flaw allows remote attackers to manipulate the id and locationType parameters to execute arbitrary SQL commands. Exploitation can lead to reading database contents and reading or writing server files via PostgreSQL superuser functions.