CVE-2019-10748

CVE-2019-10748 affects the Sequelize ORM. The vulnerability is a SQL Injection issue in Sequelize versions prior to 3.35.1, 4.44.3, and 5.8.11, caused by JSON path keys not being properly escaped in the MySQL/MariaDB dialects. The risk is high due to network-exposed attack potential and the abili...

CVE-2019-10752

CVE-2019-10752 affects the Sequelize ORM. All versions prior to 4.44.3 and 5.15.1 are vulnerable to SQL Injection because the helper function sequelize.json() does not escape values properly when formatting sub paths for JSON queries in MySQL, MariaDB and SQLite. The vulnerability is documented a...

CVE-2019-10749

CVE-2019-10749 affects sequelize prior to 3.35.1. The vulnerability arises in the Postgres dialect where JSON path keys are not properly sanitized, enabling SQL injection. Affected component: Sequelize (Node.js ORM) code paths used for generating queries with JSON path keys. Exploitation details ...

CVE-2019-11069

Severity: CVE-2019-11069 affects Sequelize versions prior to 5.3.0, where standard-conforming strings are not guaranteed, enabling potential SQL injection via backslash handling in PostgreSQL string literals. Affected component: Sequelize (Node.js ORM) in 5.x series before 5.3.0. Root cause: impr...