Threats tagged 'ghsa-v8vm-cqh8-q87q'

NocoBase plugin-collection-sql contains a vulnerability where its SQL blacklist filtering is incomplete, allowing authenticated admin users to bypass restrictions and access sensitive PostgreSQL system catalog tables and application user data. This enables exposure of password hashes and full database schema enumeration through the SQL Collection feature. The vulnerability arises from a keyword blacklist that fails to block access to critical system tables like pg_shadow and application tables such as users. A patch is available to address this issue.