Database package vulnerability