Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for node-sql-query by dresende

    CVE-2026-19351 (GCVE-0-2026-19351)

    Vulnerability from nvd – Published: 2026-08-09 11:30 – Updated: 2026-08-09 11:30 X_Open Source
    VLAI
    Title
    dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
    Summary
    A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
    7.3 (High)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    dresende node-sql-query Affected: 0.1.25
    Affected: 0.1.26
    Affected: 0.1.27
    Affected: 0.1.28
    Unaffected: 0.1.29
        cpe:2.3:a:dresende:node-sql-query:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    windhxy (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:dresende:node-sql-query:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Request Parameter Handler"
          ],
          "product": "node-sql-query",
          "vendor": "dresende",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.25"
            },
            {
              "status": "affected",
              "version": "0.1.26"
            },
            {
              "status": "affected",
              "version": "0.1.27"
            },
            {
              "status": "affected",
              "version": "0.1.28"
            },
            {
              "status": "unaffected",
              "version": "0.1.29"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "windhxy (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T11:30:10.583Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-387190 | dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/387190"
        },
        {
          "name": "VDB-387190 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/387190/cti"
        },
        {
          "name": "CVE-2026-19351 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-19351"
        },
        {
          "name": "Submit #865884 | GitHub dresende node-sql-query 0.1.25-0.1.28 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/865884"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/windhxy/CVE-my/issues/2"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/dresende/node-sql-query/pull/64"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dresende/node-sql-query/commit/3414c42f6de89826fa1f5f36f6139d1e6552778e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dresende/node-sql-query/releases/tag/v0.1.29"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dresende/node-sql-query/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-08T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-08T18:34:33.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-19351",
    "datePublished": "2026-08-09T11:30:10.583Z",
    "dateReserved": "2026-08-08T16:29:28.085Z",
    "dateUpdated": "2026-08-09T11:30:10.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19351 (GCVE-0-2026-19351)

    Vulnerability from cvelistv5 – Published: 2026-08-09 11:30 – Updated: 2026-08-09 11:30 X_Open Source
    VLAI
    Title
    dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
    Summary
    A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
    7.3 (High)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    dresende node-sql-query Affected: 0.1.25
    Affected: 0.1.26
    Affected: 0.1.27
    Affected: 0.1.28
    Unaffected: 0.1.29
        cpe:2.3:a:dresende:node-sql-query:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    windhxy (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:dresende:node-sql-query:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Request Parameter Handler"
          ],
          "product": "node-sql-query",
          "vendor": "dresende",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.25"
            },
            {
              "status": "affected",
              "version": "0.1.26"
            },
            {
              "status": "affected",
              "version": "0.1.27"
            },
            {
              "status": "affected",
              "version": "0.1.28"
            },
            {
              "status": "unaffected",
              "version": "0.1.29"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "windhxy (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 0.1.29 addresses this issue. The patch is named 3414c42f6de89826fa1f5f36f6139d1e6552778e. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T11:30:10.583Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-387190 | dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/387190"
        },
        {
          "name": "VDB-387190 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/387190/cti"
        },
        {
          "name": "CVE-2026-19351 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-19351"
        },
        {
          "name": "Submit #865884 | GitHub dresende node-sql-query 0.1.25-0.1.28 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/865884"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/windhxy/CVE-my/issues/2"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/dresende/node-sql-query/pull/64"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dresende/node-sql-query/commit/3414c42f6de89826fa1f5f36f6139d1e6552778e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/dresende/node-sql-query/releases/tag/v0.1.29"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dresende/node-sql-query/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-08T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-08T18:34:33.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-19351",
    "datePublished": "2026-08-09T11:30:10.583Z",
    "dateReserved": "2026-08-08T16:29:28.085Z",
    "dateUpdated": "2026-08-09T11:30:10.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}