Piccolo-orm vulnerabilities
We track 3 vulnerabilities in Piccolo-orm products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
Latest Piccolo-orm vulnerabilities
- 8.8 High severity
piccolo_admin: Exposure of Sensitive Information to an Unauthorized Actor
Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET reques
- 7.7 High severity
piccolo_admin: Improper Neutralization of Input During Web Page Generation
Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded ca
- 9.1 Critical severity
piccolo: Improper Neutralization of Special Elements used in an SQL Command
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an en