Monthly
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
SQL LIKE wildcard injection in ash_sql (Elixir, versions 0.1.1-rc.10 through 0.7.0) allows any user who can supply a search string to the contains/2, string_starts_with/2, or string_ends_with/2 filter functions to reintroduce live LIKE wildcards that the escape helper was intended to neutralize. The escape helper prefixes % and _ with backslash but never first escapes a backslash already present in user input, so the sequence \% survives escaping with its % intact as an unescaped wildcard, enabling attackers to widen query matches, evade negated filter guards, or crash individual queries with a trailing lone backslash. No public exploit has been identified at time of analysis, and a vendor-released fix is available in version 0.7.1.
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
SQL LIKE wildcard injection in ash_sql (Elixir, versions 0.1.1-rc.10 through 0.7.0) allows any user who can supply a search string to the contains/2, string_starts_with/2, or string_ends_with/2 filter functions to reintroduce live LIKE wildcards that the escape helper was intended to neutralize. The escape helper prefixes % and _ with backslash but never first escapes a backslash already present in user input, so the sequence \% survives escaping with its % intact as an unescaped wildcard, enabling attackers to widen query matches, evade negated filter guards, or crash individual queries with a trailing lone backslash. No public exploit has been identified at time of analysis, and a vendor-released fix is available in version 0.7.1.
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.