CWE-943 · Improper Neutralization of Special Elements in Data Query Logic (page 2)
Page 2 of 2 — CVEs classified under CWE-943, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30941 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vuln… |
CVE-2026-30833 | Medium | 5.3 | 2026-03-06 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0, a… |
CVE-2026-28211 | High | 7.8 | 2026-02-26 | The NVDA Dev & Test Toolbox is an NVDA add-on for gathering tools to help NVDA development and testing. A vulnerability exists in versions 2.0 through 8.0 in t… |
CVE-2026-25591 | Medium | 6.5 | 2026-02-24 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard… |
CVE-2026-25514 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-25513 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2025-36442 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may cr… |
CVE-2025-36366 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Ob… |
CVE-2025-36353 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due… |
CVE-2026-0504 | Low | 3.8 | 2026-01-13 | Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST… |
CVE-2025-42884 | Medium | 6.5 | 2025-11-11 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enab… |
CVE-2025-36185 | Medium | 6.2 | 2025-11-07 | IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper n… |
CVE-2025-23292 | Medium | 4.6 | 2025-09-30 | NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A… |
CVE-2025-33114 | Medium | 5.3 | 2025-07-29 | IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to denial of service with a specially crafted query under certain non-default conditions. |
CVE-2025-24787 | High | 8.6 | 2025-02-06 | WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, whi… |
CVE-2021-1481 | Medium | 4.3 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher que… |
CVE-2024-4872 | Critical | 9.9 | 2024-08-27 | A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code t… |
CVE-2024-35136 | Medium | 5.3 | 2024-08-14 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially cra… |
CVE-2024-31882 | Medium | 5.3 | 2024-08-14 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations… |
CVE-2024-28192 | Medium | 5.3 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the public access token… |
CVE-2022-36084 | Critical | 9.9 | 2022-09-08 | cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versi… |
CVE-2021-34712 | Medium | 5.4 | 2021-09-23 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct cypher query la… |
CVE-2020-36195 | Critical | 9.8 | 2021-04-17 | An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability a… |
CVE-2021-1349 | Medium | 6.5 | 2021-01-20 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query la… |
CVE-2018-19952 | High | 7.5 | 2020-11-02 | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2020-5257 | High | 7.7 | 2020-03-13 | In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated… |
CVE-2018-7829 | High | 8.8 | 2019-05-22 | An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which… |
CVE-2017-12904 | High | 8.8 | 2017-08-23 | Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to per… |