CVE-2025-5690— Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data
Quick assessment
Affected
DALIBO PostgreSQL Anonymizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DALIBO PostgreSQL Anonymizer是法国（DALIBO）公司的一个用于屏蔽或替换 PostgreSQL 数据库中的个人身份信息 (PII) 或商业敏感数据的扩展软件。 DALIBO PostgreSQL Anonymizer v2.0版本和v2.1版本存在安全漏洞，该漏洞源于允许绕过掩码规则读取原始数据。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-5690
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data
Source: CVE Program / CVE List V5
Vulnerability Description
PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg_dump. This problem occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
DALIBO PostgreSQL Anonymizer 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DALIBO PostgreSQL Anonymizer是法国（DALIBO）公司的一个用于屏蔽或替换 PostgreSQL 数据库中的个人身份信息 (PII) 或商业敏感数据的扩展软件。 DALIBO PostgreSQL Anonymizer v2.0版本和v2.1版本存在安全漏洞，该漏洞源于允许绕过掩码规则读取原始数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| DALIBO | PostgreSQL Anonymizer | 1 ~ 2.2.1 | - |
|
II. Public POCs for CVE-2025-5690
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-5690
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: PostgreSQL Anonymizer
-
CVE-2026-97469
PostgreSQL Anonymizer: RESTRICTED functions are reachable th -
CVE-2026-83534
PostgreSQL Anonymizer: Privilege escalation to superuser via -
CVE-2026-19634
PostgreSQL Anonymizer: SQL injection in import_database_rule -
CVE-2026-19633
PostgreSQL Anonymizer: unprivileged masked users can execute -
CVE-2026-13455
PostgreSQL Anonymizer: Unrestricted function can leak the se
Same vendor: DALIBO
-
CVE-2026-97469
PostgreSQL Anonymizer: RESTRICTED functions are reachable th -
CVE-2026-83534
PostgreSQL Anonymizer: Privilege escalation to superuser via -
CVE-2026-19634
PostgreSQL Anonymizer: SQL injection in import_database_rule -
CVE-2026-19633
PostgreSQL Anonymizer: unprivileged masked users can execute -
CVE-2026-13455
PostgreSQL Anonymizer: Unrestricted function can leak the se
Same weakness: CWE-200
-
CVE-2026-111930
Coder from 2.26.0 before 2.34.8 Information Disclosure via W -
CVE-2026-111926
Coder from 2.10.0 before 2.34.8 Information Disclosure via A -
CVE-2026-111904
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosur -
CVE-2026-111602
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensit -
CVE-2026-96626
Arcane: Container-registry credential exfiltration via URL r
V. Comments for CVE-2025-5690
No comments yet