Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Pixie allows attackers to inject malicious SQL

CVE-2019-10766 · published 6 years ago
Summary

A weak security feature in Pixie can let hackers inject malicious SQL code, potentially leading to unauthorized data access. This issue affects Pixie versions 1.0.x before 1.0.3 and 2.0.x before 2.0.2. To protect your system, update to the latest version of Pixie to fix this issue.

What to do
  • Update usmanhalalit pixie to version 1.0.3.
  • Update usmanhalalit pixie to version 2.0.2.
Affected software
Ecosystem VendorProductAffected versions
composer usmanhalalit pixie < 1.0.3
>= 2.0.0, < 2.0.2
Fix: upgrade to 1.0.3
– pixie_project pixie >= 1.0.0, < 1.0.3
>= 2.0.0, < 2.0.2
cpe:2.3:a:pixie_project:pixie:*:*:*:*:*:*:*:*
Original advisory text
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published19 Nov 2019
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-68wg-qv6r-j4vp · GHSA
CVE-2019-10766 · NVD
Track software like this
Free during beta