CVE-2025-10193

CVE-2025-10193 : DNS rebinding vulnerability in the Neo4j Cypher MCP server allows a malicious website to bypass Same-Origin Policy and trigger unauthorised local tool invocations. The attack relies on a user visiting a crafted site for enough time to succeed. Public details indicate impact on th...

PT-2025-37184

Name of the Vulnerable Software and Affected Versions: Neo4j Cypher MCP server affected versions not specified Description: A DNS rebinding issue exists in the Neo4j Cypher MCP server. This allows malicious websites to circumvent Same-Origin Policy protections and execute unauthorized tool...

Malicious code in cypher-rest (npm)

The package cypher-rest was found to contain malicious code...

MAL-2025-17891 Malicious code in cypher-rest (npm)

The package cypher-rest was found to contain malicious code...

CVE-2021-1481

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...

BIT-NEO4J-2024-34517

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access...

CVE-2021-1481

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...

CVE-2021-1481

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...

CVE-2021-1481 Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...

CVE-2021-1481 Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the GraphCypherQAChain class. An attacker can manipulate, delete, or create data, disrupt services, and compromise database integrity by injecting malicious SQL commands into prompts. Note: This vulnerability impac...

Exploit for SQL Injection in Langchain

Proof of Concept for Langchain CVE-2024–8309 Vulnerability...

Neo4j < 5.19.0 Privilege Mishandling (CVE-2024-34517)

According to its its self-reported version number, the version of Neo4j running on the remote host is a version prior to 5.19.0. It is, therefore, affected by a privilege mishandling vulnerability in the Cypher component which mishandles IMMUTABLE privileges. Note that Nessus has not tested for...

Unauthorized Access

org.neo4j:neo4j-cypher is vulnerable to Unauthorized Access. The vulnerability is due to the improper handling of IMMUTABLE privileges within the Cypher component, potentially leading to unauthorized access or manipulation of sensitive data by an admin authenticated attacker...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv5 (>=2.1.0 <=2.1.0-RC2), io.github.qsy7.java.dependencies:neo4j (=0.3.3) +29 more potentially affected by CVE-2024-34517 via org.neo4j:neo4j-cypher (>=5.10.0 <=5.18.1)

org.neo4j:neo4j-cypher MAVEN version =5.10.0, =2.1.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.0, =5.10.1, =5.18.0 and more Source cves: CVE-2024-34517 Source advisory: OSV:GHSA-P343-9QWP-PQXV...

GHSA-P343-9QWP-PQXV Neo4j Cypher component mishandles IMMUTABLE privileges

The Cypher component in Neo4j between v.5.0.0 and v.5.19.0 mishandles IMMUTABLE...

Neo4j Cypher component mishandles IMMUTABLE privileges

The Cypher component in Neo4j between v.5.0.0 and v.5.19.0 mishandles IMMUTABLE...

CVE-2024-34517

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access...

CVE-2024-34517

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access...

CVE-2024-34517

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access...