Skip to content
OpenAdvisories

Weakness (CWE)

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

Class Incomplete

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE-943

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2025-60357 Public exploit

    AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentE…

  • High 7.5
    CVE-2026-44840 Public exploit

    Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpw…

    dgraph-io dgraph github.com/dgraph-io/dgraph github.com/dgraph-io/dgraph/v25 Go
  • High 8.2
    CVE-2026-46591 Public exploit

    Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

    Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-202…

    Apache Software Foundation Apache Camel org.apache.camel:camel-neo4j Maven
  • High 8.3
    CVE-2026-33980 Public exploit

    Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

    Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL (Ku…

    pab1it0 adx-mcp-server adx-mcp-server PyPI
  • High 8.1
    CVE-2026-32247 Public exploit

    Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

    Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values su…

    getzep graphiti graphiti-core PyPI
  • High 8.3
    CVE-2026-25513 Public exploit

    FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the REST API that allows authenticated API users to execute arbitrary SQL queries t…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • High 8.7
    CVE-2026-25514 Public exploit

    FacturaScripts has SQL Injection vulnerability in Autocomplete Actions

    FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection vulnerability in the autocomplete functionality that allows authenticated attackers to extract sensi…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist