CVE-2014-8682
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
- EPSS
- 33% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gogits:gogs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g6xv-8q23-w2q3 | Go | gogs.io/gogs | >=0.3.1 <0.5.8 | 0.5.8 |
| GO-2022-0831 | Go | gogs.io/gogs | >=0.3.1 <0.5.8 | 0.5.8 |