165 matches found
CVE-2025-46727
CVE-2025-46727 affects Rack, a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without limiting the total number of parameters. The issue arises because R...
CVE-2025-46727 Unbounded-Parameter DoS in Rack::QueryParser
Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with...
CVE-2025-32020
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...
CVE-2025-32020
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...
CVE-2025-32020
CVE-2025-32020 affects the crud-query-parser library. The vulnerability arises from improper neutralization of the order/sort parameter in the TypeORM adapter when ordering is enabled and a property filter is not configured, enabling SQL injection. Impacted environments are those using the TypeOR...
CVE-2025-32020 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...
CVE-2025-32020 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...
CVE-2025-32020 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parser
The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter,...
crud-query-parser SQL注入漏洞
crud-query-parser is a tool by Guilherme Chaguri Personal Developer. A SQL injection vulnerability exists in crud-query-parser that stems from not properly neutralizing the order/sort parameter, resulting in SQL injection...
PT-2025-15445 · Unknown +1 · Crud-Query-Parser +1
Name of the Vulnerable Software and Affected Versions: crud-query-parser versions prior to 0.1.0 Description: The crud-query-parser library is affected by an issue where improper neutralization of the order/sort parameter in the TypeORM adapter allows SQL injection. This issue impacts users who a...
Malicious code in another-query-parser (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11296 Malicious code in another-query-parser (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9705 Malicious code in media-query-list-parser (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-34698 Prototype Pollution in getQueryParam Function (URL Query Parser)
FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the /public/js/main.js source file. The Prototype Pollution arises because the getQueryParam Function recursively merges an object containing...
CVE-2024-34698 Prototype Pollution in getQueryParam Function (URL Query Parser)
FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the /public/js/main.js source file. The Prototype Pollution arises because the getQueryParam Function recursively merges an object containing...
Spring Data JPA introduces query parser!
The Problem One of Spring Data JPA’s handy features is letting you plugin in custom JPA queries through its @Query annotation. This allows some flexiblity because you are still able to offer sort parameters to the consumers of your app. Check out the example below: interface SampleRepository...
K10631153: Apache Solr vulnerability CVE-2017-12629
Security Advisory Description Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to...
Denial Of Service (DoS)
github.com/revel/revel is vulnerable to denial of service attacks. Unsanitized input in the query parser in bindSlice function allows remote attackers to cause resource exhaustion via unbounded memory allocation resulting in denial of service...