Sql-injection

2 posts tagged with “Sql-injection”

CVE-2026-69240: Sequelize Oracle Dialect Allows SQL Injection via TO_TIMESTAMP Escape Bypass (CVSS 9.8)
cvesecurityvulnerability

CVE-2026-69240: Sequelize Oracle Dialect Allows SQL Injection via TO_TIMESTAMP Escape Bypass (CVSS 9.8)

Sequelize versions before 6.37.4 fail to escape single quotes for string values starting with TO_TIMESTAMP or TO_DATE when using the Oracle dialect. An attacker can inject arbitrary SQL through any application value that reaches this escape path.

Aug 4, 2026
Read
CVE-2026-69240: Sequelize Oracle Dialect SQL Injection (CVSS 9.8)
cvesecurityvulnerability

CVE-2026-69240: Sequelize Oracle Dialect SQL Injection (CVSS 9.8)

SQL injection in Sequelize Oracle dialect via TO_TIMESTAMP escape bypass. Fixed in 6.37.4.

Aug 4, 2026
Read