Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 22/02/2023 Updated: 03/03/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

Sequelize is a Node.js ORM tool. In versions before 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sequelizejs sequelize

Sequelize-1day-CVE-2023-25813

CWE-89 https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebadd4f78b https://github.com/sequelize/sequelize/issues/14519 https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpw https://github.com/sequelize/sequelize/releases/tag/v6.19.1 https://nvd.nist.gov https://github.com/bde574786/Sequelize-1day-CVE-2023-25813

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-25813

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect