Vulnerabilities for piccolo

First version without a known vulnerability: 1.1.1

Details

• GHSA-xq59-7jf3-rjc62023-11-12

  piccolo SQL Injection via named transaction savepoints

  Fixed in: 1.1.1, 82679eb8cd1449cf31d87c9914a072e70168b6eb

• GHSA-h7cm-mrvq-wcfr2023-09-12

  Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

  Fixed in: 0.121.0, edcfe3568382922ba3e3b65896e6e7272f972261