CVE detail
CVE-2025-1094
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 25.6 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
12 source links · newest first
- Week in review: PostgreSQL 0-day exploited in US Treasury hack, top OSINT books to learn fromHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A PostgreSQL zero-day was also exploited in US Treasury hack (CVE-2025-1094) The suspected Chinese state-sponsored hackers who breached workstations of several US Treasury employees in December 2024 did so by leveraging not one, but two zero-days, according to Rapid7 researchers. Unlocking OSINT: Top books to learn from Discover the top Open-Source Intelligence (OSINT) books in this curated list. Mastering the … More →
newswww.helpnetsecurity.comFeb 23, 2025, 9:00 AM The suspected Chinese state-sponsored hackers who breached workstations of several US Treasury employees in December 2024 did so by leveraging not one, but two zero-days, according to Rapid7 researchers. It was initially reported that the attackers compromised the Treasury’s BeyondTrust Remote Support SaaS instances via CVE-2024-12356, a previously unknown unauthenticated command injection vulnerability. But, as Rapid7 researchers discovered (and confirmed by testing), “a successful exploit for CVE-2024-12356 had to include exploitation of CVE-2025-1094 in order … More →
newswww.helpnetsecurity.comFeb 17, 2025, 1:48 PMA new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. U.S. CISA adds Apple iOS and iPadOS and Mitel SIP Phones flaws to its Known Exploited Vulnerabilities catalog […]
newssecurityaffairs.comFeb 16, 2025, 1:20 AM- Experts discovered PostgreSQL flaw chained with BeyondTrust zeroday in targeted attacksSecurity Affairs
Threat actors are exploiting a zero-day SQL injection vulnerability in PostgreSQL, according to researchers from cybersecurity firm Rapid7. Rapid7 researchers discovered a high-severity SQL injection flaw, tracked as CVE-2025-1094, in PostgreSQL’s psql tool. The experts discovered the flaw while investigating the exploitation of the vulnerability CVE-2024-12356 for remote code execution. BeyondTrust patched CVE-2024-12356 in December […]
newssecurityaffairs.comFeb 14, 2025, 9:23 AM Attackers who exploited a zero-day vulnerability in BeyondTrust Privileged Remote Access and Remote Support products in December likely also exploited a previously unknown SQL injection flaw in PostgreSQL, a widely used open-source object-relational database system. The PostgreSQL issue was fixed on Thursday and users are advised to upgrade their database servers as soon as possible. […]
newswww.csoonline.comFeb 14, 2025, 12:44 AMRapid7 finds a new zero-day vulnerability in PostgreSQL and links it to chain of attacks against a BeyondTrust Remote Support product.
newswww.securityweek.comFeb 13, 2025, 8:03 PM- https://security.netapp.com/advisory/ntap-20250221-0010/security.netapp.com
No excerpt available.
Vendor Advisorysecurity.netapp.comFeb 13, 2025, 1:15 PM No excerpt available.
Vendor Advisorylists.debian.orgFeb 13, 2025, 1:15 PMNo excerpt available.
Vendor Advisorylists.debian.orgFeb 13, 2025, 1:15 PM- http://www.openwall.com/lists/oss-security/2025/02/20/1www.openwall.com
No excerpt available.
Exploitwww.openwall.comFeb 13, 2025, 1:15 PM - http://www.openwall.com/lists/oss-security/2025/02/16/3www.openwall.com
No excerpt available.
Exploitwww.openwall.comFeb 13, 2025, 1:15 PM - https://www.postgresql.org/support/security/CVE-2025-1094/www.postgresql.org
No excerpt available.
Vendor Advisorywww.postgresql.orgFeb 13, 2025, 1:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
4 related CVEs with shared weakness or product evidence
- CVE-2026-42511CVSS 8.1 · High
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subseq…
- CVE-2018-25135CVSS 9.3 · Critical
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attack…
- CVE-2025-43878CVSS 8.3 · High
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing sys…
- CVE-2023-36479CVSS 3.5 · Low
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command exe…