CVE-2017-15099

CVE-2017-15099 is a medium-severity information disclosure vulnerability affecting PostgreSQL versions 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10. An authenticated attacker with INSERT and UPDATE privileges, but lacking full read access, can use INSERT ... ON CONFLICT DO UPDATE commands to bypass row-level security and SELECT privilege restrictions, thereby disclosing table contents. The CVSS score is 6.5 (Medium), indicating a network-exploitable vulnerability with low attack complexity and high confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this CVE.