CVE-2026-115328: Js Sql Injection Quote Splice Unparameterized Querycve-2026-115328-js-sql-injection-quote-splice-unparameterized-query
SQL query string built by splicing $VAL inside a single-quoted SQL literal ("...'" + $VAL + "'...") or by quote-wrapping a value ("'" + $VAL + "'"), then executed via $DB.query() without a parameters array. A single quote in $VAL terminates the SQL literal, so an attacker-controlled value can inject arbitrary SQL (node-postgres sends a single-string call ove
