CVE-2025-3818

EUVD-2025-15028
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.5%
Debian logo
Debian Releases
Debian Product
Codename
webpy
bookworm
1:0.62-4+deb12u1
fixed
forky
1:0.76-1
fixed
sid
1:0.76-1
fixed
trixie
1:0.62-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
webpy
bionic
Fixed 1:0.38+20170615-1ubuntu0.1~esm1
released
focal
Fixed 1:0.40-2ubuntu0.1~esm1
released
jammy
Fixed 1:0.61-1ubuntu0.1~esm1
released
noble
Fixed 1:0.62-4ubuntu0.1~esm1
released
oracular
ignored
plucky
ignored
questing
not-affected
resolute
not-affected
xenial
Fixed 1:0.37+20120626-1ubuntu0.1~esm1
released
Common Weakness Enumeration
References
https://noppgwz8if.feishu.cn/docx/TxjpddUpTokyBwxibSgcTRr7nUf
https://vuldb.com/?ctiid.305724
https://vuldb.com/?id.305724
https://vuldb.com/?submit.555649
https://lists.debian.org/debian-lts-announce/2025/05/msg00041.html