CWE-943 · 114 records
Improper Neutralization of Special Elements in Data Query Logic
CVEs in this class
114 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2026-40351No exploit | FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypassfastgpt · fastgpt · CWE-943 | Critical9.8 | — | 0.5% | Apr 17, 2026 |
39Monitor | CVE-2026-8649No exploit | Institution scope bypass vulnerability in custom reportsprogress · moveit transfer · CWE-943 | Critical9.8 | — | 0.4% | Jul 8, 2026 |
37Monitor | CVE-2017-12904No exploit | Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remonewsbeuter · newsbeuter · CWE-943 | High8.8 | — | 6.4% | Aug 23, 2017 |
37Monitor | CVE-2026-32248No exploit | Parse Server: Account takeover via operator injection in authentication data identifierparseplatform · parse-server · CWE-943 | Critical9.3 | — | 0.9% | Mar 12, 2026 |
37Monitor | CVE-2026-41274No exploit | Flowise: Cypher Injection in GraphCypherQAChainflowiseai · flowise · CWE-943 | Critical9.3 | — | 0.7% | Apr 23, 2026 |
37Monitor | CVE-2026-29793No exploit | NoSQL Injection via WebSocket id Parameter in MongoDB Adapterfeathersjs · feathers · CWE-943 | Critical9.3 | — | 0.5% | Mar 10, 2026 |
36Monitor | CVE-2018-7829No exploit | An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen.schneider-electric · d6220 firmware · CWE-943 | High8.8 | — | 1.6% | May 22, 2019 |
36Monitor | CVE-2026-45689No exploit | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATOrocketchat · rocket.chat · CWE-943 | Critical9.1 | — | 0.5% | Jun 24, 2026 |
36Monitor | CVE-2026-45688No exploit | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijackrocketchat · rocket.chat · CWE-943 | Critical9.1 | — | 0.4% | Jun 24, 2026 |
36Monitor | CVE-2026-41328No exploit | Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Fielddgraph · dgraph · CWE-943 | Critical9.1 | — | 0.4% | Apr 24, 2026 |
36Monitor | CVE-2026-41327No exploit | Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Fielddgraph · dgraph · CWE-943 | Critical9.1 | — | 0.4% | Apr 24, 2026 |
36Monitor | CVE-2026-20284No exploit | Cisco Identity Search Engine SXP REST API SQL Injection Vulnerabilitycisco · cisco identity services engine software · CWE-943 | Critical9.1 | — | 0.3% | Sep 16, 2026 |
35Monitor | CVE-2026-40352No exploit | FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeoverfastgpt · fastgpt · CWE-943 | High8.8 | — | 0.5% | Apr 17, 2026 |
35Monitor | CVE-2026-76316No exploit | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprisesplunk · splunk · CWE-943 | High8.8 | — | 0.5% | Aug 19, 2026 |
35Monitor | CVE-2024-4872No exploit | A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product.hitachienergy · microscada pro sys600 · CWE-943 | High8.8 | — | 0.4% | Aug 27, 2024 |
35Monitor | CVE-2026-76254No exploit | SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprisesplunk · splunk · CWE-943 | High8.8 | — | 0.4% | Aug 19, 2026 |
34Monitor | CVE-2026-40141No exploit | High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Accessbeyondtrust · privileged remote access · CWE-943 | High8.5 | — | 0.5% | Jul 6, 2026 |
34Monitor | CVE-2026-81525No exploit | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Drivermongodb · php driver · CWE-943 | High8.6 | — | 0.4% | Aug 27, 2026 |
34Monitor | CVE-2026-30941No exploit | Parse Server has a NoSQL injection via token type in password reset and email verification endpointsparseplatform · parse-server · CWE-943 | High8.7 | — | 0.4% | Mar 10, 2026 |
34Monitor | CVE-2026-91937No exploit | Flowise before 3.1.4 NoSQL Injection via sessionIdflowiseai · flowise · CWE-943 | High8.7 | — | 0.4% | Sep 15, 2026 |
34Monitor | CVE-2026-63637No exploit | Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriterdgraph-io · dgraph · CWE-943 | High8.6 | — | 0.4% | Aug 6, 2026 |
34Monitor | CVE-2026-73618No exploit | Budibase Server before 3.40.0 NoSQL Injection via JSON Parameterbudibase · server · CWE-943 | High8.7 | — | 0.3% | Aug 13, 2026 |
34Monitor | CVE-2026-100631No exploit | Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injectionparse-community · parse-server · CWE-943 | High8.7 | — | 0.3% | Sep 26, 2026 |
33Monitor | CVE-2026-93760No exploit | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardmongodb · mongoid · CWE-943 | High8.3 | — | 0.5% | Sep 18, 2026 |
33Monitor | CVE-2026-88022No exploit | Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravelmongodb · laravel mongodb · CWE-943 | High8.4 | — | 0.4% | Sep 10, 2026 |
- CVE-2026-4035139Monitor
FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
CriticalCVSS 9.8No exploitEPSS 0%fastgpt · fastgptApr 17, 2026
- CVE-2026-864939Monitor
Institution scope bypass vulnerability in custom reports
CriticalCVSS 9.8No exploitEPSS 0%progress · moveit transferJul 8, 2026
- CVE-2017-1290437Monitor
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remo
HighCVSS 8.8No exploitEPSS 6%newsbeuter · newsbeuterAug 23, 2017
- CVE-2026-3224837Monitor
Parse Server: Account takeover via operator injection in authentication data identifier
CriticalCVSS 9.3No exploitEPSS 0%parseplatform · parse-serverMar 12, 2026
- CVE-2026-4127437Monitor
Flowise: Cypher Injection in GraphCypherQAChain
CriticalCVSS 9.3No exploitEPSS 0%flowiseai · flowiseApr 23, 2026
- CVE-2026-2979337Monitor
NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
CriticalCVSS 9.3No exploitEPSS 0%feathersjs · feathersMar 10, 2026
- CVE-2018-782936Monitor
An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen.
HighCVSS 8.8No exploitEPSS 1%schneider-electric · d6220 firmwareMay 22, 2019
- CVE-2026-4568936Monitor
Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO
CriticalCVSS 9.1No exploitEPSS 0%rocketchat · rocket.chatJun 24, 2026
- CVE-2026-4568836Monitor
Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack
CriticalCVSS 9.1No exploitEPSS 0%rocketchat · rocket.chatJun 24, 2026
- CVE-2026-4132836Monitor
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
CriticalCVSS 9.1No exploitEPSS 0%dgraph · dgraphApr 24, 2026
- CVE-2026-4132736Monitor
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
CriticalCVSS 9.1No exploitEPSS 0%dgraph · dgraphApr 24, 2026
- CVE-2026-2028436Monitor
Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability
CriticalCVSS 9.1No exploitEPSS 0%cisco · cisco identity services engine softwareSep 16, 2026
- CVE-2026-4035235Monitor
FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
HighCVSS 8.8No exploitEPSS 0%fastgpt · fastgptApr 17, 2026
- CVE-2026-7631635Monitor
Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise
HighCVSS 8.8No exploitEPSS 0%splunk · splunkAug 19, 2026
- CVE-2024-487235Monitor
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product.
HighCVSS 8.8No exploitEPSS 0%hitachienergy · microscada pro sys600Aug 27, 2024
- CVE-2026-7625435Monitor
SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise
HighCVSS 8.8No exploitEPSS 0%splunk · splunkAug 19, 2026
- CVE-2026-4014134Monitor
High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Access
HighCVSS 8.5No exploitEPSS 0%beyondtrust · privileged remote accessJul 6, 2026
- CVE-2026-8152534Monitor
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
HighCVSS 8.6No exploitEPSS 0%mongodb · php driverAug 27, 2026
- CVE-2026-3094134Monitor
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
HighCVSS 8.7No exploitEPSS 0%parseplatform · parse-serverMar 10, 2026
- CVE-2026-9193734Monitor
Flowise before 3.1.4 NoSQL Injection via sessionId
HighCVSS 8.7No exploitEPSS 0%flowiseai · flowiseSep 15, 2026
- CVE-2026-6363734Monitor
Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
HighCVSS 8.6No exploitEPSS 0%dgraph-io · dgraphAug 6, 2026
- CVE-2026-7361834Monitor
Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
HighCVSS 8.7No exploitEPSS 0%budibase · serverAug 13, 2026
- CVE-2026-10063134Monitor
Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection
HighCVSS 8.7No exploitEPSS 0%parse-community · parse-serverSep 26, 2026
- CVE-2026-9376033Monitor
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
HighCVSS 8.3No exploitEPSS 0%mongodb · mongoidSep 18, 2026
- CVE-2026-8802233Monitor
Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel
HighCVSS 8.4No exploitEPSS 0%mongodb · laravel mongodbSep 10, 2026