VDB
CVE-2025-12819
CVE-2025-12819
PUBLISHED
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
EPSS 0.37% · 29.6th percentile
Risk Scores
EPSS Score
0.37%
29.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | pgbouncer | 0 |
| Bitnami | pgbouncer | 0 |
Timeline
- Nov 6, 2025 CVE ID Reserved
- Dec 3, 2025 CVE Published
- Dec 4, 2025 EPSS Score
- Dec 4, 2025 PoC Published
- Dec 4, 2025 PoC Published
- Dec 7, 2025 PoC Published
- Dec 8, 2025 EPSS Score
- Dec 8, 2025 PoC Published
- Dec 13, 2025 EPSS Score
- Dec 17, 2025 EPSS Score
- Dec 22, 2025 EPSS Score
- Dec 26, 2025 EPSS Score