Skip to content
OpenAdvisories

Package · Packagist

propel/propel

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    GHSA-7vw7-qx38-37vr

    Propel2 SQL injection possible with limit() on MySQL

    The limit() query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: ``` UserQuery::create()->limit('1;DROP TABLE users')->find(); ``` This will drop the users table! The cause appears to be a la…

    propel/propel Packagist