Common Weakness Enumeration
CWE-943
Allowed-with-ReviewImproper Neutralization of Special Elements in Data Query Logic
Abstraction: Class · Status: Incomplete
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
148 vulnerabilities reference this CWE, most recent first.
CVE-2026-125120 (GCVE-0-2026-125120)
Vulnerability from cvelistv5 – Published: 2026-11-09 22:36 – Updated: 2026-11-09 22:36
VLAI
EPSS
VEX
Title
Mongoose: sanitizeFilter not applied on countDocuments
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
Severity
9.8 (Critical)
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
GitHub_M
CNA
References
9 references
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/security/a… | x_refsource_CONFIRM |
| https://github.com/Automattic/mongoose/commit/7e9… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/8b1… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/b1d… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/b50… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | mongoose |
Affected:
< 6.13.11
Affected: >= 7.0.0, < 7.8.12 Affected: >= 8.0.0, < 8.24.3 Affected: >= 9.0.0, < 9.9.2 |
{
"containers": {
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "\u003c 6.13.11"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.8.12"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.24.3"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:36:16.207Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h"
},
{
"name": "https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a"
},
{
"name": "https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557"
},
{
"name": "https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d"
},
{
"name": "https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/6.13.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/6.13.11"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/7.8.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/7.8.12"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/8.24.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/8.24.3"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/9.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/9.9.2"
}
],
"source": {
"advisory": "GHSA-pcrw-h46h-c93h",
"discovery": "UNKNOWN"
},
"title": "Mongoose: sanitizeFilter not applied on countDocuments"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125120",
"datePublished": "2026-11-09T22:36:16.207Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-09T22:36:16.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125119 (GCVE-0-2026-125119)
Vulnerability from cvelistv5 – Published: 2026-11-09 22:32 – Updated: 2026-11-09 22:32
VLAI
EPSS
VEX
Title
Mongoose: Connection-level sanitizeFilter not applied
Summary
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Severity
7.5 (High)
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
GitHub_M
CNA
References
9 references
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/security/a… | x_refsource_CONFIRM |
| https://github.com/Automattic/mongoose/commit/4bb… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/4f4… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/83e… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/commit/b89… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Automattic | mongoose |
Affected:
>= 6.0.0, < 6.13.12
Affected: >= 7.0.0, < 7.8.13 Affected: >= 8.0.0, < 8.24.7 Affected: >= 9.0.0, < 9.11.4 |
{
"containers": {
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "Automattic",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.13.12"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.8.13"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.24.7"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.11.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set(\u0027sanitizeFilter\u0027) and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:32:49.132Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c"
},
{
"name": "https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29"
},
{
"name": "https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491"
},
{
"name": "https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5"
},
{
"name": "https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/6.13.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/6.13.12"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/7.8.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/7.8.13"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/8.24.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/8.24.7"
},
{
"name": "https://github.com/Automattic/mongoose/releases/tag/9.11.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/releases/tag/9.11.4"
}
],
"source": {
"advisory": "GHSA-gg4r-jv3p-qx3c",
"discovery": "UNKNOWN"
},
"title": "Mongoose: Connection-level sanitizeFilter not applied"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125119",
"datePublished": "2026-11-09T22:32:49.132Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-09T22:32:49.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123791 (GCVE-0-2026-123791)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:45 – Updated: 2026-11-06 21:45
VLAI
EPSS
VEX
Title
OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection
Summary
A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CWE
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431935 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431935/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123791 | third-party-advisory |
| https://vuldb.com/submit/1033611 | third-party-advisory |
| https://github.com/OpenBMB/IoA/issues/19 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenBMB | Internet of Agents |
Affected:
9d78e88e47160eb42ee1ee8538c05e1c2c47877a
cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:*"
],
"modules": [
"Agent Registry"
],
"product": "Internet of Agents",
"vendor": "OpenBMB",
"versions": [
{
"status": "affected",
"version": "9d78e88e47160eb42ee1ee8538c05e1c2c47877a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Evo1ution (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:45:15.925Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431935 | OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431935"
},
{
"name": "VDB-431935 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431935/cti"
},
{
"name": "CVE-2026-123791 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123791"
},
{
"name": "Submit #1033611 | OpenBMB Internet of Agents(IoA) 9d78e88 Improper Neutralization of Special Elements in Data Query Logic",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033611"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/OpenBMB/IoA/issues/19"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T15:52:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123791",
"datePublished": "2026-11-06T21:45:15.925Z",
"dateReserved": "2026-11-06T14:47:10.833Z",
"dateUpdated": "2026-11-06T21:45:15.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123617 (GCVE-0-2026-123617)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-06 17:23
VLAI
EPSS
VEX
Title
Openwhyd before 1.65.1 NoSQL Injection via POST /api/user
Summary
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:22 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/openwhyd/openwhyd/security/adv… | vendor-advisory |
| https://github.com/openwhyd/openwhyd/commit/167c4… | patch |
| https://github.com/openwhyd/openwhyd/releases/tag… | release-notes |
| https://github.com/openwhyd/openwhyd/blob/v1.65.0… | technical-description |
| https://www.vulncheck.com/advisories/openwhyd-bef… | third-party-advisory |
Impacted products
Date Public
2026-11-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123617",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:22:17.779718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:23:41.281Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwhyd/openwhyd/security/advisories/GHSA-hfg3-vq24-hprp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/openwhyd/openwhyd",
"product": "openwhyd",
"repo": "https://github.com/openwhyd/openwhyd",
"vendor": "openwhyd",
"versions": [
{
"lessThan": "1.65.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwhyd:openwhyd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.65.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tommaso Bona (ParzivalHack)"
},
{
"lang": "en",
"type": "finder",
"value": "satoridev01"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Adrien Joly"
}
],
"datePublic": "2026-11-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users\u0027 public profile records."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:53.519Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hfg3-vq24-hprp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwhyd/openwhyd/security/advisories/GHSA-hfg3-vq24-hprp"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/openwhyd/openwhyd/commit/167c45d6754df0adb3415f71cbd7cde91cbe7874"
},
{
"name": "openwhyd v1.65.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/openwhyd/openwhyd/releases/tag/v1.65.1"
},
{
"name": "Vulnerable lookup in app/models/user.js",
"tags": [
"technical-description"
],
"url": "https://github.com/openwhyd/openwhyd/blob/v1.65.0/app/models/user.js#L288-L294"
},
{
"name": "VulnCheck Advisory: Openwhyd before 1.65.1 NoSQL Injection via POST /api/user",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwhyd-before-1.65.1-nosql-injection-via-post-api-user"
}
],
"title": "Openwhyd before 1.65.1 NoSQL Injection via POST /api/user",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123617",
"datePublished": "2026-11-06T15:00:53.519Z",
"dateReserved": "2026-11-06T01:04:42.201Z",
"dateUpdated": "2026-11-06T17:23:41.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120567 (GCVE-0-2026-120567)
Vulnerability from cvelistv5 – Published: 2026-11-03 19:36 – Updated: 2026-11-06 19:52
VLAI
EPSS
VEX
Title
EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference
Summary
The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:51 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
mongodb
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | Entity Framework Core Provider |
Affected:
9.1.3 , ≤ 9.1.4
(semver)
Affected: 10.0.3 , ≤ 10.0.4 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120567",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:51:28.459131Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:52:10.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Entity Framework Core Provider",
"vendor": "MongoDB",
"versions": [
{
"lessThanOrEqual": "9.1.4",
"status": "affected",
"version": "9.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.4",
"status": "affected",
"version": "10.0.3",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them."
}
],
"value": "The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T16:30:53.153Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/EF-478"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-120567",
"datePublished": "2026-11-03T19:36:46.042Z",
"dateReserved": "2026-11-02T16:36:20.651Z",
"dateUpdated": "2026-11-06T19:52:10.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120201 (GCVE-0-2026-120201)
Vulnerability from cvelistv5 – Published: 2026-10-31 17:25 – Updated: 2026-11-02 14:35
VLAI
EPSS
VEX
Title
Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
Summary
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:35 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dromara/Jpom/issues/121 | issue-tracking |
| https://github.com/dromara/Jpom/blob/v2.11.12/mod… | technical-description |
| https://github.com/dromara/Jpom | product |
| https://www.vulncheck.com/advisories/jpom-2.10.0-… | third-party-advisory |
Impacted products
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120201",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:35:05.869681Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:35:22.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.dromara.jpom/server",
"product": "Jpom",
"repo": "https://github.com/dromara/Jpom",
"vendor": "dromara",
"versions": [
{
"lessThanOrEqual": "2.11.12",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "LioTree"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like \u0027is not null\u0027, which Hutool\u0027s Condition parser treats as an operator, then execute commands through Jpom\u0027s script features."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T17:25:50.846Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #121",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dromara/Jpom/issues/121"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/common/interceptor/LoginInterceptor.java#L146"
},
{
"tags": [
"product"
],
"url": "https://github.com/dromara/Jpom"
},
{
"name": "VulnCheck Advisory: Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jpom-2.10.0-through-2.11.12-authentication-bypass-via-jpom-user-token-header"
}
],
"title": "Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120201",
"datePublished": "2026-10-31T17:25:50.846Z",
"dateReserved": "2026-10-31T11:44:46.680Z",
"dateUpdated": "2026-11-02T14:35:22.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118645 (GCVE-0-2026-118645)
Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-10-29 20:54
VLAI
EPSS
VEX
Title
n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
Summary
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:28 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-1… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:28:45.488305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:54:42.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "1.123.85",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.123.85",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.44.1",
"status": "affected",
"version": "2.44.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.44.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.43.5",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.43.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.123.85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.44.1",
"versionStartIncluding": "2.44.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.43.5",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Masofgon"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential\u0027s privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:59:44.935Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-65mv-v8rp-54wc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-65mv-v8rp-54wc"
},
{
"name": "VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-filter-injection-via-quick-base-node-where-parameter"
}
],
"title": "n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118645",
"datePublished": "2026-10-28T18:59:44.935Z",
"dateReserved": "2026-10-28T17:24:54.846Z",
"dateUpdated": "2026-10-29T20:54:42.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118641 (GCVE-0-2026-118641)
Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-10-29 20:54
VLAI
EPSS
VEX
Title
n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
Summary
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:28 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-1… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:28:36.441528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:54:49.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "1.123.85",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.123.85",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.44.1",
"status": "affected",
"version": "2.44.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.44.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.43.5",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.43.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.123.85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.44.1",
"versionStartIncluding": "2.44.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.43.5",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "sm1ee"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox\u0027s entire contact list or redirect SharePoint writes onto unintended list items within the stored credential\u0027s scope."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:59:40.104Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mgpr-56r4-5c67)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-mgpr-56r4-5c67"
},
{
"name": "VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-odata-filter-injection-via-outlook-and-sharepoint-nodes"
}
],
"title": "n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118641",
"datePublished": "2026-10-28T18:59:40.104Z",
"dateReserved": "2026-10-28T17:24:54.846Z",
"dateUpdated": "2026-10-29T20:54:49.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118581 (GCVE-0-2026-118581)
Vulnerability from cvelistv5 – Published: 2026-10-28 16:51 – Updated: 2026-11-05 17:06
VLAI
EPSS
VEX
Title
NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
Summary
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application's credentials.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 17:06 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
mongodb
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | Java Driver |
Affected:
5.8.0 , < 5.14.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T17:06:03.569086Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:06:27.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Java Driver",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "5.14.0",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document\u0027s self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application\u0027s credentials."
}
],
"value": "A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document\u0027s self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application\u0027s credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:51:21.960Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://github.com/mongodb/mongo-java-driver/releases/tag/r5.14.0"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-118581",
"datePublished": "2026-10-28T16:51:21.960Z",
"dateReserved": "2026-10-28T16:00:23.372Z",
"dateUpdated": "2026-11-05T17:06:27.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116801 (GCVE-0-2026-116801)
Vulnerability from cvelistv5 – Published: 2026-10-26 23:05 – Updated: 2026-10-27 14:16
VLAI
EPSS
VEX
Title
Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
Summary
Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 13:42 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/parse-community/parse-server/s… | vendor-advisory |
| https://www.vulncheck.com/advisories/parse-server… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| parse-community | parse-server |
Affected:
9.0.0 , < 9.10.5-alpha.6
(semver)
Unaffected: 9.10.5-alpha.6 (semver) |
|
| parse-community | parse-server |
Affected:
0 , < 8.6.105
(semver)
Unaffected: 8.6.105 (semver) |
Date Public
2026-10-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T13:42:07.586416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T14:16:07.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "9.10.5-alpha.6",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.10.5-alpha.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "8.6.105",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.6.105",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10.5-alpha.6",
"versionStartIncluding": "9.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.6.105",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tan-JunWei"
},
{
"lang": "en",
"type": "coordinator",
"value": "mtrezza"
}
],
"datePublic": "2026-10-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T23:05:33.735Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-58m4-cqvw-4vgh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-58m4-cqvw-4vgh"
},
{
"name": "VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.6-acl-bypass-via-relatedto-query"
}
],
"title": "Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116801",
"datePublished": "2026-10-26T23:05:33.735Z",
"dateReserved": "2026-10-26T22:13:13.605Z",
"dateUpdated": "2026-10-27T14:16:07.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-676: NoSQL Injection
An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authentication, and/or executing code.