Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A fail-open condition was detected where an exception during identifier enquoting, escaping, or validation results in the method returning the raw, unescaped input. This logic bypasses the intended escaping mechanism and leads to secondary Injection vulnerabilities (e.g., SQL Injection) if the attacker provides malicious input designed specifically to trigge
A custom database shim `mysql_prepare` was used. In CVE-2026-48249, this shim was found to be insecure and vulnerable to SQL injection despite impersonating a prepared statement API. Replace with `db_query()` using parameter arrays or migrate to standard PDO/mysqli.
Unvalidated dictionary keys from user-controlled input are passed directly to the `ChildQuery` structure. An attacker can inject arbitrary SQL functions or logic by manipulating these dictionary keys. Dictionary keys supplied via JSON or API requests must be validated (e.g. by rejecting uppercase SQL function names using `.isupper()`) before query constructi
Detected the direct injection of a dynamic object property (such as an AST node's `.value`) as the first argument to `knex.raw()`. This bypasses query parameterization and enables SQL injection if the property holds user-controlled data. The first argument of `knex.raw()` must be a static SQL string. Dynamic user inputs must be passed safely via the second a
Directly using an unvalidated AST node `.value` in a raw SQL query execution (e.g., $DB.raw()) can lead to SQL injection. Validate the node's value against an explicit allowlist (e.g., 'asc', 'desc') before passing it to the builder.
Directly passing the `.value` of an AST node argument into the query template of `knex.raw()` without validation can lead to SQL Injection. Ensure the literal is safely validated, wrapped in a sanitizing function, or use parameterized bindings array before execution.
Direct injection of formula argument literal values (`.value`) into `knex.raw()`. This bypasses query parametrization and allows arbitrary SQL execution if a user provides malicious input. Validate the value against a strict allowedlist (e.g., 'asc', 'desc') before passing it to `knex.raw()`.
Directly passing the `.value` of an AST argument (like `pt.arguments[1]?.value`) to `knex.raw()` without validation can lead to SQL injection. Ensure the variable is validated against a strict allowlist (e.g., 'asc', 'desc') before usage.
Unvalidated dictionary keys are directly instantiated into `ChildQuery` objects. This allows attackers to inject malicious SQL syntax or arbitrary SQL functions via dictionary keys. Ensure key strings are validated (e.g. by checking if they are uppercase with `.isupper()`) before usage.
An unvalidated AST node value (`.value`) is passed directly into a raw SQL query binding (`knex.raw()`). In NocoDB formula resolution, passing a literal string this way without parameterization or strict allowlisting (such as for 'ASC' or 'DESC') allows an attacker to bypass basic sanitization and execute arbitrary SQL injection via the ORDER BY clause. Ensu
Executing a DROP TABLE or SHOW CREATE TABLE query with a dynamic, unquoted template variable directly following the SQL keyword. This lacks specifying a database context or properly quoting the identifier, which can cause the operation to execute against an unintended default database (e.g., in a multi-tenant environment) or lead to unintentional injections.
Direct string interpolation of user-controlled array keys or values from a request array without allowlist validation can lead to injection vulnerabilities like SQL Injection.
The query builder improperly assumes any dictionary passed within a fields list is a child query definition, instantiating ChildQuery without validating child_field keys. This allows SQL injection via the keys.
The Frappe query builder passes user-controllable dictionary keys directly into `ChildQuery` as field names. This lacks validation and allows attackers to specify unsupported SQL functions or arbitrary SQL syntax disguised as childfields, resulting in SQL Injection.
Direct configuration of database query builders via `Craft::configure()` using unsanitized user criteria arrays can lead to SQL injection. An attacker can inject arbitrary SQL fragments by including keys like 'where', 'join', or 'having'. Ensure that unsafe array keys are unset from the criteria array prior to configuration.
Passing a criteria array to `Craft::configure()` through `Component::cleanseConfig()` does not sufficiently sanitize query-building properties. `cleanseConfig()` fails to strip dangerous SQL schema attributes such as `where`, `union`, or `params`. If the array is user-controlled, this leads to SQL injection. Ensure you explicitly `unset()` unsupported or dan
A SQL injection vulnerability exists because the application uses Python's `str.format()` to dynamically evaluate unescaped variables directly into a SQL query string. This enables arbitrary SQL command execution, which can be leveraged for IDOR or Authentication Bypass. Use the database driver's built-in parameterization by passing variables as a tuple to t
An authorization check (check_access) is gated behind a "not in <allowlist>" conditional. Resources whose identifier is in the allowlist bypass the authorization check entirely. This pattern was the root cause of CVE-2026-42031 in CKAN's datastore_search, where the WHITELISTED_RESOURCES shortcut allowed enumeration of private resources via _table_metadata an
Bypass of field validation for dictionary keys passed to ChildQuery. If dictionary keys from user-controlled JSON are passed without validation, attackers can inject SQL or call unauthorized SQL functions. Validate keys (e.g., check string properties or reject uppercase) before using them as field names.
Potential DQL injection (CVE-2026-41327): a user-controlled upsert `cond` value is being transformed by `strings.Replace($X, "@if", "@filter", 1)` and concatenated into a DQL query without prior structural validation. The `strings.Replace` call is a cosmetic syntax rewrite, not a security boundary. An attacker can craft a `cond` that closes the `@filter(...)
SQL query is built by interpolating request-derived values into a JavaScript template literal and passed to `.query()` with no parameter values array. Under node-postgres, a missing params argument dispatches via the simple query protocol, which neither parameterises values nor blocks stacked (semicolon-separated) statements — enabling SQL injection and, wit
Validator/checker function ends with a permissive catch-all clause that returns `:ok` (or `{:ok, ...}`) for any unhandled input. When this function is used to vet user-controlled data that flows into a security-sensitive sink (such as a SQL query string built via string interpolation), the catch-all enables bypass of validation and may lead to SQL injection
A blocklist of illegal JDBC connection parameters was found containing known dangerous properties, but it omits `allowMultiQueries`. If an attacker can configure `allowMultiQueries=true` on a MySQL connection used in unchecked contexts, they may execute stacked queries, leading to severe SQL injection.
Unvalidated assignment to a variable representing a database table name. This allows potentially malicious strings to be used in dynamic SQL queries, leading to SQL Injection. Validate table names by restricting allowed characters, checking length, and ensuring the table exists.
