SQL Injection via GeoJSON in sequelize

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-1000225 · ADVISORY
• sequelize/sequelize · WEB
• sequelize/sequelize#6302 · WEB
• sequelize/sequelize#6306 · WEB
• sequelize/sequelize commit 14e3dea · WEB
• sequelize/sequelize commit 18ac910 · WEB
• sequelize/sequelize commit 562d525 · WEB
• sequelize/sequelize commit f93af43 · WEB
• sequelize/sequelize · PACKAGE
• snyk.io/vuln/npm:sequelize:20160718 · WEB

sequelize のその他の脆弱性

• CVE-2026-69240緊急 9.8Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape functi…
• CVE-2026-30951高 7.5Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The …
• CVE-2023-25813緊急 9.8Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are pa…
• CVE-2023-22580高 7.5Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.
• CVE-2023-22579高 8.8Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.