CVE-2025-3818: webpy web.py db.py PostgresDB._process_insert_query sql injection

Published Apr 19, 2025

Updated

A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB.processinsertquery of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected Software

1 affected component

webpy web.py

Event History

Apr 19, 2025

CVE Published

via MITRE·07:31 PM

Data Sourced

via MITRE·07:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Aug 5, 57285

Event

via FIRST·03:40 AM

Frequently Asked Questions

What is the severity of CVE-2025-3818?

CVE-2025-3818 is classified as a critical vulnerability.

How does CVE-2025-3818 exploit vulnerability work?

CVE-2025-3818 allows for SQL injection through manipulation of the seqname argument in the function PostgresDB._process_insert_query.

Who is affected by CVE-2025-3818?

CVE-2025-3818 affects users of webpy web.py version 0.70.

How do I fix CVE-2025-3818?

To fix CVE-2025-3818, update to the latest version of webpy that addresses the SQL injection vulnerability.

Can CVE-2025-3818 be exploited remotely?

Yes, CVE-2025-3818 can be exploited remotely, making it a significant risk.