CVE-2014-8682
NoneCVSS
—
EPSS
33.4%
Published
Nov 21, 2014
CISA due date
—
The record
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | gogs.io/gogs | 0.3.1 | 0.5.8 |
| go | gogs.io/gogs | 0.3.1 | 0.5.8 |
Related vulnerabilities
- GO-2026-4501 Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs Also affects gogs.io/gogs
- GO-2026-4498 Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs Also affects gogs.io/gogs
- GO-2026-4499 Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in… Also affects gogs.io/gogs
- GO-2026-4500 Unauthenticated File Upload in Gogs in gogs.io/gogs Also affects gogs.io/gogs
- CVE-2026-25232 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25242 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25229 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25120 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs