Skip to content
OpenAdvisories

Vendor

sequelize

3 known vulnerabilities.

Products

sequelize 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-69240

    Sequelize: SQL Injection (Oracle DB)

    Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dial…

    sequelize sequelize sequelize npm
  • Critical 10.0
    CVE-2023-25813 Public exploit

    SQL Injection via replacements in sequelize

    Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific …

    sequelize sequelize sequelize npm