CVE-2025-3818
webpy web.py db.py PostgresDB._process_insert_query sql injection
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
webpy web.py db.py PostgresDB._process_insert_query sql injection
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
CVE-2025-3818- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89, CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2025-15028
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
EUVD-2025-15028- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9g47-36rw-gjh2
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is...
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
GHSA-9g47-36rw-gjh2- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
CVE-2025-3818- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-74, CWE-89
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-3818
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
DEBIAN-CVE-2025-3818- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-3818
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
UBUNTU-CVE-2025-3818- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSV No score
A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Record
CVE-2025-3818- Updated
- 2026-11-02
OSVUSN-8443-1 No score
webpy vulnerability
It was discovered that web.py incorrectly handled sequence names in PostgreSQL insert queries. An attacker could possibly use this issue to perform SQL injection attacks, resulting in the alteration or exposure of database information.
- Record
USN-8443-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webpyDebian:12 |
before 1:0.62-4+deb12u1, plus listed versions 1:0.62-4 |
1:0.62-4+deb12u1 |
webpyDebian:13 |
before 1:0.62-6 | 1:0.62-6 |
webpyDebian:14 |
before 1:0.62-6 | 1:0.62-6 |
webpyDebian:11 |
before 1:0.61-1+deb11u1, plus listed versions 1:0.61-1 |
1:0.61-1+deb11u1 |
webpyUbuntu:Pro:16.04:LTS |
before 1:0.37+20120626-1ubuntu0.1~esm1, plus listed versions 1:0.37+20120626-1 |
1:0.37+20120626-1ubuntu0.1~esm1 |
webpyUbuntu:Pro:18.04:LTS |
before 1:0.38+20170615-1ubuntu0.1~esm1, plus listed versions 1:0.38-11:0.38+20170615-1 |
1:0.38+20170615-1ubuntu0.1~esm1 |
webpyUbuntu:Pro:20.04:LTS |
before 1:0.40-2ubuntu0.1~esm1, plus listed versions 1:0.39+20181101-11:0.40-2 |
1:0.40-2ubuntu0.1~esm1 |
webpyUbuntu:Pro:22.04:LTS |
before 1:0.61-1ubuntu0.1~esm1, plus listed versions 1:0.61-1 |
1:0.61-1ubuntu0.1~esm1 |
webpyUbuntu:Pro:24.04:LTS |
before 1:0.62-4ubuntu0.1~esm1, plus listed versions 1:0.62-4 |
1:0.62-4ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3818 is a medium vulnerability (CVSS 5.3) in Webpy Web.py, published April 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in webpy 1:0.62-4+deb12u1.