EUVD-2026-116927

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

CVE-2026-121007

The SQL::Abstract Perl module (versions 1.90_01 to 2.000001_04 ) is vulnerable to SQL injection . The root cause is that nested statements (e.g., { -select => ... }) placed in positions where plain scalars are treated as identifiers—such as the select list , ORDER BY , GROUP BY , RETURNING , a...

CVE-2026-121007: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

PT-2026-136979

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. The...

GHSA-VQFX-GJ96-3W95 Unsafe fall-through in getWhereConditions

Impact Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error. A finder call like the following did not throw an error: ts User.findAll where: new Date, ; As this option is typically used with plain javascript objects, be awar...