Skip to content
OpenAdvisories

Vendor

piccolo-orm

4 known vulnerabilities.

Products

piccolo 2 piccolo_admin 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2023-41885

    Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

    Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the p…

    piccolo-orm piccolo piccolo PyPI