Skip to content
OpenAdvisories
Medium USN-8443-1 1 CVE

webpy vulnerability

Published Jun 17, 2026 · Updated Jun 17, 2026

Ecosystem: Ubuntu

Summary

It was discovered that web.py incorrectly handled sequence names in
PostgreSQL insert queries. An attacker could possibly use this issue
to perform SQL injection attacks, resulting in the alteration or exposure
of database information.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS webpy 1:0.37+20120626-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS webpy 1:0.38+20170615-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS webpy 1:0.40-2ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS webpy 1:0.61-1ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS webpy 1:0.62-4ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 6.3
    CVE-2025-3818

    webpy web.py db.py PostgresDB._process_insert_query sql injection

    A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the a…

    webpy web.py webpy webpy Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-3818