Servers and applications
CVE-2007-3279
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
- Severity
- High 10.0
- Published
- 19 Jun 2007
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 16 Oct 2026
- Exploit chance
- 2.6% in the next 30 daysHigher than 85% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Over the network · No login needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
AV:N/AC:L/Au:N/C:C/I:C/A:C- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
PostgreSQLServers and applications · cpe:a:postgresql:postgresql |
|