Skip to content
OpenAdvisories

Weakness (CWE)

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

Class Incomplete

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE-943

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-54350 Public exploit

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the bu…

    Budibase budibase @budibase/server npm
  • Critical 9.2
    CVE-2026-27886 Public exploit Scanner template

    Strapi may leak sensitive data via relational filtering due to lack of query sanitization

    Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` q…

    strapi strapi @strapi/strapi npm