CVE-2019-10766
CRITICALCVSS 9.8/10EPSS 1.50%
Last modified
CVE-2019-10766 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.. EPSS estimates a 1.50% chance of exploitation in the next 30 days.
Description
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pixie Project | Pixie | >= 1.0.0, < 1.0.3 |
| Pixie Project | Pixie | >= 2.0.0, < 2.0.2 |
References
- https://snyk.io/vuln/SNYK-PHP-USMANHALALITPIXIE-534879Exploit, Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-PHP-USMANHALALITPIXIE-534879Exploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10766?
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
How severe is CVE-2019-10766?
CVE-2019-10766 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.50% probability of exploitation in the next 30 days.
How do I fix CVE-2019-10766?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10760safer-eval before 1.3.2 are vulnerable to Arbitrary Code Exe…9.9
- CVE-2019-10761This affects the package vm2 before 3.6.11. It is possible t…8.3
- CVE-2019-10762columnQuote in medoo before 1.7.5 allows remote attackers to…9.8
- CVE-2019-10763pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection.…6.5
- CVE-2019-10764In elliptic-php versions priot to 1.0.6, Timing attacks migh…7.4
- CVE-2019-10765iobroker.admin before 3.6.12 allows attacker to include file…9.8
- CVE-2019-10767An attacker can include file contents from outside the `/ada…7.5
- CVE-2019-10768In AngularJS before 1.7.9 the function `merge()` could be tr…7.5
- CVE-2019-10769safer-eval is a npm package to sandbox the he evaluation of …9.8
- CVE-2019-1077An elevation of privilege vulnerability exists when the Visu…
- CVE-2019-10770All versions of io.ratpack:ratpack-core from 0.9.10 inclusiv…6.1
- CVE-2019-10771Characters in the GET url path are not properly escaped and …6.1
Are you affected by CVE-2019-10766?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST