https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:00:22 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-00005 bdu:2022-00005 https://cve.radiocsirt.org/vuln/bdu:2022-00005 https://cve.radiocsirt.org/vuln/euvd-2026-53934 EUVD-2026-53934 https://cve.radiocsirt.org/vuln/euvd-2026-53934 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10752 <p>Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.</p> <p>Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-10752 https://cve.radiocsirt.org/vuln/ghsa-m9jw-237r-gvfv <p><strong>Affected:</strong> npm: sequelize</p> <p>Affected versions of `sequelize` are vulnerable to SQL Injection. The function `sequelize.json()` incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:</p> <p>```js return User.findAll({ where: this.sequelize.json(&#34;data.id&#39;)) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- &#34;, 1) }); ```</p> <p>## Recommendation</p> <p>If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later. If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.</p> <p><strong>Affected:</strong> npm: sequelize</p> <p>Affected versions of `sequelize` are vulnerable to SQL Injection. The function `sequelize.json()` incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:</p> <p>```js return User.findAll({ where: this.sequelize.json(&#34;data.id&#39;)) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- &#34;, 1) }); ```</p> <p>## Recommendation</p> <p>If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later. If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-m9jw-237r-gvfv https://cve.radiocsirt.org/vuln/gsd-2019-10752 gsd-2019-10752 https://cve.radiocsirt.org/vuln/gsd-2019-10752