failing-line (0.0.1), mp3s (0.0.0) +3 more potentially affected by unknown CVE via findall (0.0.4)

findall NPM version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on findall and may be impacted: - failing-line 0.0.1 - mp3s 0.0.0 - ourtunes =0.0.0, =0.0.2, =0.0.3, =2.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-20572...

GHSA-4HX3-M8W5-G5QH yii2-redis Potential Remote code execution

Potential remote code execution in LUA context of the redis server via methods yii\redis\ActiveRecord::findOne and yii\redis\ActiveRecord::findAll in yiisoft/yii2-redis. Attackers could probably manipulate data on the redis server...

SQL Injection in sequelize

Affected versions of sequelize are vulnerable to SQL Injection in locations where user input is passed into the limit or order parameters of sequelize query calls, such as findOne or findAll. Recommendation Update to version 3.17.0 or later...

GHSA-98PQ-PMW9-4GPM SQL Injection in sequelize

Affected versions of sequelize are vulnerable to SQL Injection in locations where user input is passed into the limit or order parameters of sequelize query calls, such as findOne or findAll. Recommendation Update to version 3.17.0 or later...

Sql injection

The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne or findAll call, unless a developer recognizes an undocumented need to sanitize array input...

CVE-2018-7269

The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne or findAll call, unless a developer recognizes an undocumented need to sanitize array input...

Possibility of manipulated condition when unfiltered input is passed to `yii\elasticsearch\ActiveRecord::findOne()` and `::findAll()`

More info at https://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/...