onyx

onyx --cves cve-2022-31197

CVE-2022-31197

HIGHKEVPOCPostgreSQL
score
0.1
cvss
7.1
epss
2.4% ▲0.1
published
2022-08-03
kev added
2025-12-08
first seen

PostgreSQL JDBC Driver versions before 42.2.26 and 42.4.1 contain a SQL injection caused by unescaped column names in the refreshRow() method, letting attackers execute arbitrary SQL commands if the application invokes this method and queries malicious schemas, exploit requires tricking the user into executing SQL on malicious schema.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2022-08-03 — PublishedP2025-12-08 — Added to CISA KEVK2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoCXscore2026-10-21: score 0.10.1epss2026-09-22: epss 2.1%2026-09-23: epss 2.1%2026-09-24: epss 2.1%2026-09-25: epss 2.1%2026-09-26: epss 2.1%2026-09-27: epss 2.2%2026-09-28: epss 2.2%2026-09-29: epss 2.2%2026-09-30: epss 2.2%2026-10-01: epss 2.2%2026-10-02: epss 2.2%2026-10-03: epss 2.2%2026-10-04: epss 2.2%2026-10-05: epss 2.2%2026-10-06: epss 2.2%2026-10-07: epss 2.2%2026-10-08: epss 2.2%2026-10-09: epss 2.2%2026-10-10: epss 2.2%2026-10-11: epss 2.2%2026-10-12: epss 2.2%2026-10-13: epss 2.2%2026-10-14: epss 2.2%2026-10-15: epss 2.2%2026-10-16: epss 2.2%2026-10-18: epss 2.2%2026-10-19: epss 2.2%2026-10-20: epss 2.4%2026-10-21: epss 2.4%2.4%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx
  4. Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-89

References 7