CVE-2016-10550

NONE EPSS 77.3%
Published May 31, 20188y ago · Modified Jun 17, 20262w ago
Find Similar
Published May 31, 2018 8y ago
Last Modified Jun 17, 2026 2w ago

Description

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.

Threat Intelligence

EPSS Exploit Probability
77.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
sequelizejssequelize* ≤3.16.0

References 2

  • github.com https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03
    PatchThird Party Advisory
  • nodesecurity.io https://nodesecurity.io/advisories/112
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03
    PatchThird Party Advisory
  • nodesecurity.io https://nodesecurity.io/advisories/112
    PatchThird Party Advisory