Improper Neutralization of Special Elements in Data Query Logic
CWE-943
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
We track 77 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
Latest Improper Neutralization of Special Elements in Data Query Logic vulnerabilities
- 8.8 High severity
Splunk Enterprise: Improper Neutralization of Special Elements in Data Query Logic
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workfl
- 8.8 High severity
Splunk Enterprise: Improper Neutralization of Special Elements in Data Query Logic
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which
- 8.3 High severity
server: Improper Neutralization of Special Elements in Data Query Logic
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query wr
- 7.1 High severity
server: Improper Neutralization of Special Elements in Data Query Logic
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operato
- 8.6 High severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or
- 9.8 Critical severity
MOVEit Transfer: Improper Neutralization of Special Elements in Data Query Logic
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.
- 7.2 High severity
MOVEit Transfer: Improper Neutralization of Special Elements in Data Query Logic
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.
- 7.5 High severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd
- 9.9 Critical severity
Remote Support: Improper Neutralization of Special Elements in Data Query Logic
A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated atta
- 8.2 High severity
Apache Camel: Improper Neutralization of Special Elements in Data Query Logic
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025
- 9.8 Critical severity
budibase: Improper Neutralization of Special Elements used in an SQL Command
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the bui
- 9.1 Critical severity
Rocket.Chat: Improper Neutralization of Special Elements in Data Query Logic
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user
- 9.1 Critical severity
Rocket.Chat: Improper Neutralization of Special Elements in Data Query Logic
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS login handler forwards the client-supplied options.cas.credentialToken value straight i
- 7.5 High severity
Spring AI: Improper Neutralization of Special Elements in Data Query Logic
In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store
- 8.7 High severity
PenguinMod-BackendApi is the backend api for penguinmod.
PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any authenticated user to change the password of an account, leading to full account takeover. An attacker on
- 7.1 High severity
BuddyPress: Improper Neutralization of Special Elements in Data Query Logic
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metac
- 7.5 High severity
strapi: Improper Limitation of a Pathname to a Restricted Directory
Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` qu
- 7.1 High severity
flowsint: Improper Neutralization of Special Elements in Data Query Logic
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a node with a malicious type that can escape an existing Cypher query and an adversar
- 9.1 Critical severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where A
- 9.1 Critical severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where A
- 9.8 Critical severity
Flowise: Improper Neutralization of Special Elements in Data Query Logic
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inj
- 8.8 High severity
FastGPT: Improper Neutralization of Special Elements in Data Query Logic
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an at
- 9.8 Critical severity
FastGPT: Improper Neutralization of Special Elements in Data Query Logic
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g., {"$ne": ""
- 8.1 High severity
adx-mcp-server: Improper Neutralization of Special Elements in Data Query Logic
Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Kus
- 7.7 High severity
UniFi Network Application: Improper Neutralization of Special Elements in Data Query Logic
An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges.
- 8.8 High severity
Wakyma application web: Improper Neutralization of Special Elements used in an SQL Command
Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-tags'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the pur
- 9.8 Critical severity
parse-server: Improper Neutralization of Special Elements in Data Query Logic
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does no
- 8.1 High severity
graphiti: Improper Neutralization of Special Elements in Data Query Logic
Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values sup
- 9.8 Critical severity
mongodb: Improper Neutralization of Special Elements in Data Query Logic
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove)
- 7.5 High severity
parse-server: Improper Neutralization of Special Elements in Data Query Logic
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in
- 7.8 High severity
NVDA-Dev-Test-Toolbox: Improper Neutralization of Special Elements in Data Query Logic
The NVDA Dev & Test Toolbox is an NVDA add-on for gathering tools to help NVDA development and testing. A vulnerability exists in versions 2.0 through 8.0 in the Log Reader feature of this add-on. A maliciously crafted log file can lead to arbitrary code execu
- 8.8 High severity
FacturaScripts is open-source enterprise resource planning and accounting software.
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensit
- 8.8 High severity
FacturaScripts is open-source enterprise resource planning and accounting software.
FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries th
- 7.5 High severity
Db2 for Linux, UNIX and Windows: Improper Neutralization of Special Elements in Data Query Logic
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns.
- 7.5 High severity
whodb: Improper Neutralization of Special Elements in Data Query Logic
WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The applicati
- 8.8 High severity
MicroSCADA X SYS600: Improper Neutralization of Special Elements in Data Query Logic
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability an attacker must have a
- 8.8 High severity
cruddl: Improper Neutralization of Special Elements in Output Used by a Downstream Component
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schem