Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Aug 3, 2026Sequelize is a Node.js ORM tool.CVE-2026-69240 · Other software · sequelize · reported by GitHubCritical 9.8
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. This issue is fixed in version 6.37.4.
- Product
- sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Sequelize is a Node.js ORM tool.CVE-2026-30951 · Other software · sequelize · reported by GitHubHigh 7.5
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
- Product
- sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Nov 24, 2023Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.CVE-2023-6293 · Other software · robinbuschmann · reported by security@huntr.devHigh 7.1
Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.
- Product
- robinbuschmann/sequelize-typescript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Sequelize is a Node.js ORM tool.CVE-2023-25813 · Other software · sequelize · reported by GitHubCritical 10
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query.
- Product
- sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.CVE-2023-22580 · Other software · Feathers-Sequalize · reported by csirt@divd.nlMedium 5.3
Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.
- Product
- Sequelize.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Feb 16, 2023Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.CVE-2023-22579 · Other software · Feathers-Sequalize · reported by csirt@divd.nlCritical 9.9
Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.
- Product
- Sequelize.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Feb 16, 2023Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.CVE-2023-22578 · Other software · Feathers-Sequalize · reported by csirt@divd.nlCritical 10
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
- Product
- Sequelize.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Oct 29, 2019sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.CVE-2019-10749 · Other software · Sequelizejs · reported by report@snyk.ioCritical 9.8
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
- Product
- Sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2019Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDCVE-2019-10748 · Other software · Sequelizejs · reported by report@snyk.ioCritical 9.8
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
- Product
- Sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2019Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly CVE-2019-10752 · Other software · Sequelizejs · reported by report@snyk.ioCritical 9.8
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
- Product
- Sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2019Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.CVE-2019-11069 · Other software · Sequelizejs · reported by MITREHigh 7.5
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
- Product
- Sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2018sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for CVE-2016-10554 · Other software · HackerOne · reported by support@hackerone.comCritical 9.8
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escaping.
- Product
- sequelize node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
May 31, 2018sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for CVE-2016-10553 · Other software · HackerOne · reported by support@hackerone.comCritical 9.8
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
- Product
- sequelize node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
May 31, 2018sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for CVE-2016-10550 · Other software · HackerOne · reported by support@hackerone.comCritical 9.8
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
- Product
- sequelize node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
May 29, 2018sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for CVE-2016-10556 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This causes potential SQL injection in sequelize 3.19.3 and earlier, where a malicious user could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } }); ``` and cause the SQL statement to become `SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')`. In Postgres, MSSQL, and SQLite, the backslash has no special meaning. This causes the the statement to delete whichever Id has a value of 1 in the TestTable table.
- Product
- sequelize node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Jan 27, 2015SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.CVE-2015-1369 · Other software · Sequelize Project · reported by Red HatHigh 7.5
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
- Product
- Sequelize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.