Improper Neutralization of Special Elements in Data Query Logic
CWE-943
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
We track 77 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
Latest Improper Neutralization of Special Elements in Data Query Logic vulnerabilities
- 8.2 High severity
n8n: Improper Neutralization of Special Elements in Data Query Logic
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming
- 7.6 High severity
OpenManage Ansible Modules: Improper Neutralization of Special Elements in Data Query Logic
Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially e
- 9.8 Critical severity
mongoose: Improper Neutralization of Special Elements in Data Query Logic
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application tha
- 7.5 High severity
mongoose: Improper Neutralization of Special Elements in Data Query Logic
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditio
- 7.3 High severity
A vulnerability was detected in OpenBMB Internet of Agents up to…
A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument
- 7.5 High severity
chartbrew: Improper Neutralization of Special Elements in Data Query Logic
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, a date-typed MongoDB variable placed inside a quoted query placeholder was inserted as an unescaped string, unlike th
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural valid
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The
- 7.6 High severity
yeti: Improper Neutralization of Special Elements in Data Query Logic
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL id
- 9.8 Critical severity
Jpom: Improper Neutralization of Special Elements in Data Query Logic
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', w
- 8.7 High severity
n8n: Improper Neutralization of Special Elements in Data Query Logic
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data us
- 7.5 High severity
n8n: Improper Neutralization of Special Elements in Data Query Logic
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindab
- 7.6 High severity
C# Driver: Improper Neutralization of Special Elements in Data Query Logic
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these
- 7.1 High severity
flexible-graphrag: Improper Encoding or Escaping of Output
Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/f
- 7.1 High severity
trudesk: Improper Neutralization of Special Elements in Data Query Logic
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to l
- 7.5 High severity
Ghost: Observable Discrepancy
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could a
- 7.1 High severity
djehuty: Improper Neutralization of Special Elements in Data Query Logic
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT)
- 8.4 High severity
djehuty: Improper Neutralization of Special Elements in Data Query Logic
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (an
- 8.1 High severity
n8n: Improper Neutralization of Special Elements in Data Query Logic
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query ope
- 7.5 High severity
parse-server: Improper Neutralization of Special Elements in Data Query Logic
Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields befor
- 7.1 High severity
Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An
- 8.2 High severity
Mongoid: Improper Neutralization of Special Elements in Data Query Logic
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no cred
- 9.1 Critical severity
Cisco Identity Services Engine Software: Improper Neutralization of Special Elements in Data Query Logic
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulne
- 7.5 High severity
Flowise: Improper Neutralization of Special Elements in Data Query Logic
Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history record
- 7.7 High severity
langchain-mongodb: Improper Neutralization of Special Elements in Data Query Logic
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() incorporate filter dic
- 8.3 High severity
C Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
C++ Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticate
- 8.3 High severity
Java Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 8.1 High severity
Go Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
Ruby Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 8.3 High severity
Python Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentic
- 8.1 High severity
Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a lit
- 8.3 High severity
C# Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
Rust Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 8.3 High severity
MongoDB PHP Library: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 7.7 High severity
Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argu
- 7.4 High severity
Microsoft Discovery Studio: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.
- 8.1 High severity
PHP Library: Improper Neutralization of Special Elements in Data Query Logic
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into t
- 9.8 Critical severity
n8n: Improper Neutralization of Special Elements in Data Query Logic
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker
- 8.1 High severity
Splunk Enterprise: Improper Neutralization of Special Elements in Data Query Logic
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to