CWE-943: NoSQL Injection, NoSQLi
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Also known as Improper Neutralization of Special Elements in Data Query Logic.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- openwebui open webui, open-webui +1 moreOpen WebUI: RAG ACL Bypass in Milvus Multitenancy Mode6.5 Medium
- spring ai, vmware spring ai +1 moreSpring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores8.6 High
- langchain-ai langgraphjs@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access6.7 Medium
- macwarrior clipbucket-v5ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite4.3 Medium
- penguinmod penguinmod-backendapiPenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account Takeover8.7 High
- broadcom spring data relational, spring data relational, data jdbc +1 more +3 moreSpring Data Relational Parameter not Escaped for Query By Example LIKE Pattern4.8 Medium
- spring data mongodb, vmware spring data mongodb +1 moreSpring Data MongoDB Bind Parameter Literal Quoting Breakout5.9 Medium
- buddypressBuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution7.1 High
- makeplane planePlane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics6.5 Medium
- strapiStrapi may leak sensitive data via relational filtering due to lack of query sanitization9.2 Critical
- reconurge flowsintFlowsint: Cypher query injection in node type on node creation7.1 High
- azure kafka-sink-azure-kustoKQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto5.9 Medium
- shellhubShellHub: Crash-DoS via field injection in filter and sort-by parameters5.4 Medium
- japan computer emergency response team coordination center (jpcert/cc) logontracerThere is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows...5.1 Medium
- dgraphDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field9.1 Critical
- dgraphDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field9.1 Critical
- cockpit-hq cockpitCockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection5.3 Medium
- fastgptFastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover8.8 High
- fastgptFastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass9.8 Critical
- flowiseai flowise, flowise-components +1 moreFlowise: Cypher Injection in GraphCypherQAChain9.3 Critical
github.com/authorizerdev/authorizerGoAuthorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation7.3 High- phpmyfaqphpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure6.9 Medium
- pab1it0 azure data explorer mcp server, adx-mcp-server +1 moreAzure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries8.3 High
- spring ai, vmware spring ai +1 moreSpring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters7.5 High
- spring ai, vmware spring ai +1 moreServer-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore7.5 High
- ubiquiti inc unifi network applicationAn Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a...7.7 High
- wakyma, wakyma application web +1 moreNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web5.3 Medium
- wakyma, wakyma application web +1 moreNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web7.1 High
- wakyma, wakyma application web +1 moreNon-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web7.1 High
- parse-community parse-serverParse Server: Account takeover via operator injection in authentication data identifier9.3 Critical
- getzep graphitiGraphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters8.1 High
- syliusSylius has a DQL Injection via API Order Filters5.3 Medium
- @feathersjs mongodb, feathersjs feathers +1 moreNoSQL Injection via WebSocket id Parameter in MongoDB Adapter9.3 Critical
- parse-community parse-serverParse Server has a NoSQL injection via token type in password reset and email verification endpoints8.7 High
- rocket.chatRocket.Chat: NoSQL injection in the EE ddp-streamer-service6.9 Medium
- cyrilleb79 nvda-dev-test-toolboxArbitrary code execution in log reader via untrusted log file7.8 High
- newapi new api, quantumnous new-api +1 moreNew API has an SQL LIKE Wildcard Injection DoS via Token Search7.1 High
- facturascriptsFacturaScripts has SQL Injection vulnerability in Autocomplete Actions8.7 High
- facturascriptsFacturaScripts has SQL Injection vulnerability in API ORDER BY Clause8.3 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Denial of Service6.2 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Denial of Service6.5 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 Denial of Service6.5 Medium
- apache camel, apache software foundation camel neo4j +1 moreApache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component5.3 Medium
- sap se identity managementInsufficient Input Handling in JNDI Operations of SAP Identity Management3.8 Low
- sap se netweaver enterprise portalJNDI Injection vulnerability in SAP NetWeaver Enterprise Portal6.5 Medium
- ibm db2IBM Db2 denial of service6.2 Medium
- nvidia dls component of nvidia license systemNVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection...4.6 Medium
- ibm db2IBM Db2 for Linux denial of service5.3 Medium
- clidey whodbParameter injection in DB connection URIs leading to local file inclusion in WhoDB8.6 High
- cisco catalyst sd-wan managerCisco SD-WAN vManage Cypher Query Language Injection Vulnerability4.3 Medium
- Show moreLoading…