Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/14223?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/14223?format=api", "vulnerability_id": "VCID-z5df-1r9g-n7dz", "summary": "PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection\nThe pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.", "aliases": [ { "alias": "CVE-2009-2940" }, { "alias": "GHSA-xv6x-43gq-4hfj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/936130?format=api", "purl": "pkg:deb/debian/pygresql@1:4.0-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:4.0-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053064?format=api", "purl": "pkg:deb/debian/pygresql@1:4.0-2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:4.0-2" }, { "url": "http://public2.vulnerablecode.io/api/packages/936128?format=api", "purl": "pkg:deb/debian/pygresql@1:5.1.2-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:5.1.2-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/936126?format=api", "purl": "pkg:deb/debian/pygresql@1:5.1.2-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:5.1.2-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/936129?format=api", "purl": "pkg:deb/debian/pygresql@1:6.1.0-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:6.1.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/50377?format=api", "purl": "pkg:pypi/pygresql@4.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pygresql@4.1" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1053060?format=api", "purl": "pkg:deb/debian/pygresql@1:3.6.1-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5df-1r9g-n7dz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:3.6.1-1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053061?format=api", "purl": "pkg:deb/debian/pygresql@1:3.8.1-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5df-1r9g-n7dz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:3.8.1-1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053062?format=api", "purl": "pkg:deb/debian/pygresql@1:3.8.1-1etch2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5df-1r9g-n7dz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:3.8.1-1etch2" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053063?format=api", "purl": "pkg:deb/debian/pygresql@1:3.8.1-3%2Blenny1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5df-1r9g-n7dz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/pygresql@1:3.8.1-3%252Blenny1" }, { "url": "http://public2.vulnerablecode.io/api/packages/50375?format=api", "purl": "pkg:pypi/pygresql@3.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5df-1r9g-n7dz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pygresql@3.8.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/50376?format=api", "purl": "pkg:pypi/pygresql@4.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-z5df-1r9g-n7dz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/pygresql@4.0" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2940.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2940.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2009-2940", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.6881", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.68788", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.68769", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.68717", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.68739", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.687", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00576", "scoring_system": "epss", "scoring_elements": "0.68719", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68977", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68862", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68904", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68914", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68942", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68949", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68954", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68934", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00579", "scoring_system": "epss", "scoring_elements": "0.68891", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2009-2940" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2940", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2940" }, { "reference_url": "https://github.com/PyGreSQL/PyGreSQL", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/PyGreSQL/PyGreSQL" }, { "reference_url": "https://github.com/PyGreSQL/PyGreSQL/commit/8e19320b130946eed6f043297e3e4e005a523612", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/PyGreSQL/PyGreSQL/commit/8e19320b130946eed6f043297e3e4e005a523612" }, { "reference_url": "https://github.com/PyGreSQL/PyGreSQL/commit/f7237d773e6f4d5a7da3d99bb6bc5062bd07935e", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/PyGreSQL/PyGreSQL/commit/f7237d773e6f4d5a7da3d99bb6bc5062bd07935e" }, { "reference_url": "http://ubuntu.com/usn/usn-870-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://ubuntu.com/usn/usn-870-1" }, { "reference_url": "http://www.debian.org/security/2009/dsa-1911", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2009/dsa-1911" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1516701", "reference_id": "1516701", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1516701" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2940", "reference_id": "CVE-2009-2940", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2940" }, { "reference_url": "https://github.com/advisories/GHSA-xv6x-43gq-4hfj", "reference_id": "GHSA-xv6x-43gq-4hfj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xv6x-43gq-4hfj" }, { "reference_url": "https://usn.ubuntu.com/870-1/", "reference_id": "USN-870-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/870-1/" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 89, "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "description": "The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component." }, { "cwe_id": 79, "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "description": "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users." } ], "exploits": [], "severity_range_score": "5.4 - 8.9", "exploitability": "0.5", "weighted_severity": "8.0", "risk_score": 4.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z5df-1r9g-n7dz" }