VDB
CVE-2025-12819
CVE-2025-12819
PUBLISHED
CVSS 8.100000381469727 HIGH
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
EPSS 0.36% · 28.8th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.36%
28.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | pgbouncer | 0 |
| Bitnami | pgbouncer | 0 |
Timeline
- Nov 6, 2025 CVE ID Reserved
- Dec 3, 2025 CVE Published
- Dec 4, 2025 EPSS Score
- Dec 4, 2025 PoC Published
- Dec 4, 2025 PoC Published
- Dec 7, 2025 PoC Published
- Dec 8, 2025 PoC Published
- Dec 9, 2025 EPSS Score
- Dec 14, 2025 EPSS Score
- Dec 19, 2025 EPSS Score
- Dec 24, 2025 EPSS Score
- Dec 27, 2025 CVE Updated