CVE-2020-25696

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-183CWE-697

Affected software

No affected versions have been published.

Timeline

Published
Nov 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-256977.0A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker tCVE-2020-256987.5Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could leadCVE-2020-256997.5In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles witCVE-2020-25705.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and CVE-2020-257006.5In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 toCVE-2020-257015.3If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would eCVE-2020-257026.1In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodleCVE-2020-257035.3The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. VersiCVE-2020-257045.5A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local useCVE-2020-257057.4A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attackeCVE-2020-257066.1A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during teCVE-2020-257087.5A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message