Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-47111 State: PUBLISHED Published: 2023-11-08T21:42:27.853Z Last Updated: 2024-09-12T18:59:25.343Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: zitadel Products: zitadel Problem Types: CWE-362 Description: ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit, will lock the user and prevent further authentication. In the affected implementation it was possible for an attacker to start multiple parall
prevent further authentication. In the affected implementation it was possible for an attacker to start multiple parallel password checks, giving him the possibility to try out more combinations than configured in the `Lockout Policy`. This vulnerability has been patched in versions 2.40.5 and 2.38.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-7h8m-vrxx-vr4m - https://github.com/zitadel/zitadel/commit/22e2d5599918864877e054ebe82fb834a5aa1077 - https://github.com/zitadel/zitadel/releases/tag/v2.38.3 - https://github.com/zitadel/zitadel/releases/tag/v2.40.5
CVE ID: CVE-2023-47112 State: PUBLISHED Published: 2023-11-16T22:01:07.727Z Last Updated: 2024-08-29T14:48:58.458Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: rundeck Products: rundeck Problem Types: CWE-862 Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks. The output of these endpoints only exposes the name of job groups and the j
without the necessary authorization checks. The output of these endpoints only exposes the name of job groups and the jobs contained within the specified project. The output is read-only and the access does not allow changes to the information. This vulnerability has been patched in version 4.17.3. Users are advised to upgrade. Users unable to upgrade may block access to the two URLs used in either Rundeck Open Source or Process Automation products at a load balancer level. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rundeck/rundeck/security/advisories/GHSA-xvmv-4rx6-x6jx
CVE ID: CVE-2023-47113 State: PUBLISHED Published: 2023-11-08T21:57:47.549Z Last Updated: 2024-09-06T17:54:06.422Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: bleachbit Products: bleachbit Problem Types: CWE-427 Description: BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:\DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been patched in version 4.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bleachb
.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bleachbit/bleachbit/security/advisories/GHSA-j8jc-f6p7-55p8
CVE ID: CVE-2023-47114 State: PUBLISHED Published: 2023-11-08T21:50:45.465Z Last Updated: 2024-09-04T14:04:23.644Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: ethyca Products: fides Problem Types: CWE-79 Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected
controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that
ected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. This vulnerability has been patched in version 2.23.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisori
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38 - https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1 - https://github.com/ethyca/fides/releases/tag/2.23.3
CVE ID: CVE-2023-47115 State: PUBLISHED Published: 2024-01-23T22:49:03.958Z Last Updated: 2025-05-30T14:18:15.145Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: HumanSignal Products: label-studio Problem Types: CWE-79 Description: Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For a
d result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For an example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. The file `users/functions.py` lines 18-49 show that the only verification check is that the file is an image by extracting the dimensions from the file. Label Studio serves avatar images using Django's built-in `serve` view, which is not secure for production use according to Django's documentation. The issue with the Django `serve` view is that it determines the `Content-Type` of the response by the file extension in the URL path
h the Django `serve` view is that it determines the `Content-Type` of the response by the file extension in the URL path. Therefore, an attacker can upload an image that contains malicious HTML code and name the file with a `.html` extension to be rendered as a HTML page. The only file extension validation is performed on the client-side, which can be easily bypassed. Version 1.9.2 fixes this issue. Other remediation strategies include validating the file extension on the server side, not in client-side code; removing the use of Django's `serve` view and implement a secure controller for viewing uploaded avatar images; saving file content in the database rather than on the filesystem to miti
controller for viewing uploaded avatar images; saving file content in the database rather than on the filesystem to mitigate against other file related vulnerabilities; and avoiding trusting user controlled inputs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/security/advisories/GHSA-q68h-xwq5-mm7x - https://github.com/HumanSignal/label-studio/commit/a7a71e594f32ec4af8f3f800d5ccb8662e275da3 - https://docs.djangoproject.com/en/4.2/ref/views/#serving-files-in-development - https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/users/functions.py#L18-L49 - https://github.com/HumanSignal/label-s
com/HumanSignal/label-studio/blob/1.8.2/label_studio/users/functions.py#L18-L49 - https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/users/urls.py#L25-L26
CVE ID: CVE-2023-47116 State: PUBLISHED Published: 2024-01-31T16:21:50.793Z Last Updated: 2025-06-17T21:29:19.276Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HumanSignal Products: label-studio Problem Types: CWE-918 Description: Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP a
eb servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r - https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64 - https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
CVE ID: CVE-2023-47117 State: PUBLISHED Published: 2023-11-13T20:13:32.396Z Last Updated: 2025-01-08T21:12:58.865Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HumanSignal Products: label-studio Problem Types: CWE-200 Description: Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an at
ploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/s
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6hjj-gq77-j4qw - https://github.com/HumanSignal/label-studio/commit/f931d9d129002f54a495995774ce7384174cef5c
CVE ID: CVE-2023-47118 State: PUBLISHED Published: 2023-12-20T16:30:21.942Z Last Updated: 2024-08-02T21:01:22.658Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: ClickHouse Products: ClickHouse Problem Types: CWE-122 Description: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not requi
ing a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-g22g-p6q2-x39v
CVE ID: CVE-2023-47119 State: PUBLISHED Published: 2023-11-10T15:00:38.158Z Last Updated: 2024-09-03T18:56:52.373Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-74 Description: Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds. Additional Analyst
h and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-j95w-5hvx-jp5w - https://github.com/discourse/discourse/commit/628b293ff53fb617b3464dd27268aec84388cc09 - https://github.com/discourse/discourse/commit/d78357917c6a917a8a27af68756228e89c69321c
CVE ID: CVE-2023-47120 State: PUBLISHED Published: 2023-11-10T15:09:54.389Z Last Updated: 2024-09-03T18:55:29.162Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `
hich Onebox it. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-77cw-xhj8-hfp3 - https://github.com/discourse/discourse/commit/95a82d608d6377faf68a0e2c5d9640b043557852 - https://github.com/discourse/discourse/commit/e910dd09140cb4abc3a563b95af4a137ca7fa0ce
CVE ID: CVE-2023-47121 State: PUBLISHED Published: 2023-11-10T15:13:42.254Z Last Updated: 2025-02-27T20:33:47.097Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-918 Description: Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature. Additional Analyst
2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-hp24-94qf-8cgc - https://github.com/discourse/discourse/commit/24cca10da731734af4e9748de99a508d586e59f1 - https://github.com/discourse/discourse/commit/5f20748e402223b265e6fee381472c14e2604da6
CVE ID: CVE-2023-47122 State: PUBLISHED Published: 2023-11-10T21:33:55.421Z Last Updated: 2024-09-03T15:24:07.931Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: sigstore Products: gitsign Problem Types: CWE-347 Description: Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - a
trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc - https://github.com/sigstore/gitsign/pull/399 - https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236 - https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model
CVE ID: CVE-2023-47123 State: PUBLISHED Published: 2024-04-15T17:31:21.407Z Last Updated: 2024-08-02T21:01:22.830Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-mx8x-693w-9hjp - https://gith
Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-mx8x-693w-9hjp - https://github.com/Combodo/iTop/commit/34ba4fa0ce99534f751d9f170fe0eda103e20c72
CVE ID: CVE-2023-47124 State: PUBLISHED Published: 2023-12-04T20:20:30.727Z Last Updated: 2024-12-18T14:12:58.629Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: traefik Products: traefik Problem Types: CWE-772 Description: Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HT
en patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f - https://doc.traefik.io/traefik/https/acme/#dnschallenge - https://doc.traefik.io/traefik/https/acme/#httpchallenge - https://doc.traefik.io/traefik/https/acme/#tlschallenge - https://github.com/traefik/traefik/releases/tag/v2.10.6 - https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 - https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris
CVE ID: CVE-2023-47125 State: PUBLISHED Published: 2023-11-14T20:07:56.433Z Last Updated: 2024-08-29T20:25:31.869Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: html-sanitizer Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Pro
Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54 - https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff - https://typo3.org/security/advisory/typo3-core-sa-2023-007
CVE ID: CVE-2023-47126 State: PUBLISHED Published: 2023-11-14T20:01:16.570Z Last Updated: 2024-08-29T20:34:33.323Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-200 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no
tallations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-p2jh-95jg-2w55 - https://github.com/TYPO3/typo3/commit/1a735dac01ec7b337ed0d80c738caa8967dea423 - https://typo3.org/security/advisory/typo3-core-sa-2023-005
CVE ID: CVE-2023-47127 State: PUBLISHED Published: 2023-11-14T19:26:07.849Z Last Updated: 2024-08-29T20:42:22.685Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: TYPO3 Products: typo3 Problem Types: CWE-302 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4
additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm - https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019 - https://typo3.org/security/advisory/typo3-core-sa-2023-006
CVE ID: CVE-2023-47128 State: PUBLISHED Published: 2023-11-10T18:11:07.863Z Last Updated: 2024-09-03T17:28:09.878Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: piccolo-orm Products: piccolo Problem Types: CWE-89 Description: Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they wou