Skip to content
OpenAdvisories

Weakness (CWE)

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

Class Incomplete

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE-943

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-79483 Public exploit

    FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHisto…

  • Medium 6.3
    CVE-2026-56096 Public exploit

    Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field…

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • Medium 6.7
    CVE-2026-48121 Public exploit

    @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access

    @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from con…

    langchain-ai langgraphjs @langchain/langgraph-checkpoint-mongodb npm