Skip to content
OpenAdvisories

Package · PyPI

piccolo

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.1
    CVE-2023-47128

    piccolo SQL Injection via named transaction savepoints

    Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an e…

    piccolo-orm piccolo piccolo PyPI
  • Medium 5.3
    CVE-2023-41885

    Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

    Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the p…

    piccolo-orm piccolo piccolo PyPI