PT-2025-25328 · Go-Pg+1 · Go-Pg+1

Published 2025-06-12 · Updated 2026-01-26 · CVE-2024-44905

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions go-pg pg version 10.13.0

Description A SQL injection issue was discovered in the component /types/append value.go. This allows for potential SQL injection attacks.

Recommendations For go-pg pg version 10.13.0, consider restricting access to the append value function in the /types/append value.go component until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-44905

GHSA-6XP3-P59P-Q4FJ

GO-2025-3764

OPENSUSE-SU-2025:15405-1

SUSE-SU-2026:0037-1

SUSE-SU-2026:0292-1

Affected Products

Debian

Go-Pg

References · 170

• 🔥 https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf · Exploit
• 🔥 https://sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw · Exploit
• https://osv.dev/vulnerability/GO-2025-3764 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44905 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-44905 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6xp3-p59p-q4fj · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-44905 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0292-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-44905 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-44905 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-44905 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44905 · Security Note
• https://github.com/go-pg/pg/releases/tag/v10.15.0 · Note