Monthly
Unauthenticated SPARQL injection in djehuty, the 4TU.ResearchData research data repository, before version 26.3.2 lets remote attackers manipulate the SELECT queries behind the search and listing endpoints through three separate request parameters, enabling cross-graph data exfiltration and resource-exhaustion denial of service. Because no account, credentials, or user interaction are required, any instance exposing its search/listing functionality to the network is at risk; the injected queries are read-only, so no data can be written or altered, but triples held in graphs outside the request's intended scope (drafts, private, or internal RDF data) can be pulled in via UNION-style constructs, and deliberately expensive or malformed queries can tie up the SPARQL backend and web workers. A vendor-released patch exists in 26.3.2 and has been published as advisory GHSA-7gp2-rxw9-vw6p, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper neutralization of query syntax in djehuty, the 4TU.ResearchData research data repository, lets an authenticated depositor supply a crafted session name that is concatenated into a state-modifying SPARQL DELETE/INSERT query, giving them arbitrary write and delete access to triples anywhere in the RDF metadata store. Because that store is shared across every account and dataset in a normal deployment, the result is a repository-wide metadata integrity and availability compromise rather than a self-contained tenant issue (assessed CVSS 3.1 8.1, vendor CVSS 4.0 8.4). The prerequisite is a low barrier: authentication requirements confirmed from the CVSS vector as authenticated (PR:L), but djehuty permits self-registration through ORCID/SAML, so in typical deployments almost anyone can obtain the account needed; no public exploit identified at time of analysis and vendor-released patch: 26.3.2.
Authenticated Ghost members on sites running versions 5.9.0 through 6.44.0 can read comments they are not authorized to view, resulting in disclosure of restricted comment content through the native comments feature. The root cause is an input validation / query-logic authorization bypass (CWE-943), reachable over the network with low complexity and no user interaction; the vendor and VulnCheck assign a CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), which our assessment maps to a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no integrity or availability impact. Exposure is conditional on the site having membership and the native comments feature enabled and running an affected version; exploitation requires a valid low-privilege member account (PR:L), and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can delete every device registration in a Parse Server application - or any attacker-chosen subset - by submitting non-string (object) values in installation/device-token fields that are used to build the deduplication query without type validation. The only prerequisite is knowledge of the public application ID, which is intentionally distributed inside client apps; no account, session token, master key, or user interaction is required, and the destructive cleanup runs with elevated privileges before class-level permissions are evaluated. Parse Server versions prior to 8.6.90 and 9.0.0 through 9.10.1-alpha.9 are affected in the default configuration that exposes the REST API to clients and uses push notifications, and because deleted registrations cannot be recovered server-side, push delivery halts until every client re-registers; no public exploit identified at time of analysis, and the vendor-released patch is 8.6.90 or 9.10.1-alpha.9.
Cache lock takeover in the MongoDB integration for Laravel (mongodb/laravel-mongodb) before 5.11.0 lets an authenticated user who can influence the lock 'owner' value hijack or prematurely expire a lock held by another process, producing duplicated or conflicting operations. The root cause is a NoSQL/aggregation-expression injection (CWE-943) in the MongoLock implementation, where a dollar-prefixed owner string such as '$owner', '$literal' or '$$ROOT' is evaluated by MongoDB as an aggregation expression instead of being treated as a literal value. CVSS 7.1 (VI:H, VA:L, no confidentiality or scope impact) places this as a genuine but moderate integrity-focused flaw: it only affects deployments using the MongoDB cache-lock backend on pre-5.11.0 versions, exploitability depends on the application deriving lock owner values from user-influenced input (not the standard usage pattern), and no public exploit code has been identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
An unauthenticated NoSQL injection in Flowise before 3.1.4 lets remote attackers read other users' chat history by abusing the overrideConfig.sessionId parameter handled by the MongoDBMemory node. The parameter is passed into MongoDB queries without sanitization, so submitting MongoDB operator objects (e.g. $ne, $regex, $gt) through the prediction API causes the query to match records belonging to other users in the shared chat collection. Only confidentiality is affected (CVSS 4.0 base 8.7, VC:H, no integrity or availability impact); no CISA KEV listing, EPSS score, or public exploit code was provided at time of analysis, and vendor patch status is 'available' with version 3.1.4 as the fix.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
Unauthenticated SPARQL injection in djehuty, the 4TU.ResearchData research data repository, before version 26.3.2 lets remote attackers manipulate the SELECT queries behind the search and listing endpoints through three separate request parameters, enabling cross-graph data exfiltration and resource-exhaustion denial of service. Because no account, credentials, or user interaction are required, any instance exposing its search/listing functionality to the network is at risk; the injected queries are read-only, so no data can be written or altered, but triples held in graphs outside the request's intended scope (drafts, private, or internal RDF data) can be pulled in via UNION-style constructs, and deliberately expensive or malformed queries can tie up the SPARQL backend and web workers. A vendor-released patch exists in 26.3.2 and has been published as advisory GHSA-7gp2-rxw9-vw6p, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper neutralization of query syntax in djehuty, the 4TU.ResearchData research data repository, lets an authenticated depositor supply a crafted session name that is concatenated into a state-modifying SPARQL DELETE/INSERT query, giving them arbitrary write and delete access to triples anywhere in the RDF metadata store. Because that store is shared across every account and dataset in a normal deployment, the result is a repository-wide metadata integrity and availability compromise rather than a self-contained tenant issue (assessed CVSS 3.1 8.1, vendor CVSS 4.0 8.4). The prerequisite is a low barrier: authentication requirements confirmed from the CVSS vector as authenticated (PR:L), but djehuty permits self-registration through ORCID/SAML, so in typical deployments almost anyone can obtain the account needed; no public exploit identified at time of analysis and vendor-released patch: 26.3.2.
Authenticated Ghost members on sites running versions 5.9.0 through 6.44.0 can read comments they are not authorized to view, resulting in disclosure of restricted comment content through the native comments feature. The root cause is an input validation / query-logic authorization bypass (CWE-943), reachable over the network with low complexity and no user interaction; the vendor and VulnCheck assign a CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), which our assessment maps to a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no integrity or availability impact. Exposure is conditional on the site having membership and the native comments feature enabled and running an affected version; exploitation requires a valid low-privilege member account (PR:L), and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can delete every device registration in a Parse Server application - or any attacker-chosen subset - by submitting non-string (object) values in installation/device-token fields that are used to build the deduplication query without type validation. The only prerequisite is knowledge of the public application ID, which is intentionally distributed inside client apps; no account, session token, master key, or user interaction is required, and the destructive cleanup runs with elevated privileges before class-level permissions are evaluated. Parse Server versions prior to 8.6.90 and 9.0.0 through 9.10.1-alpha.9 are affected in the default configuration that exposes the REST API to clients and uses push notifications, and because deleted registrations cannot be recovered server-side, push delivery halts until every client re-registers; no public exploit identified at time of analysis, and the vendor-released patch is 8.6.90 or 9.10.1-alpha.9.
Cache lock takeover in the MongoDB integration for Laravel (mongodb/laravel-mongodb) before 5.11.0 lets an authenticated user who can influence the lock 'owner' value hijack or prematurely expire a lock held by another process, producing duplicated or conflicting operations. The root cause is a NoSQL/aggregation-expression injection (CWE-943) in the MongoLock implementation, where a dollar-prefixed owner string such as '$owner', '$literal' or '$$ROOT' is evaluated by MongoDB as an aggregation expression instead of being treated as a literal value. CVSS 7.1 (VI:H, VA:L, no confidentiality or scope impact) places this as a genuine but moderate integrity-focused flaw: it only affects deployments using the MongoDB cache-lock backend on pre-5.11.0 versions, exploitability depends on the application deriving lock owner values from user-influenced input (not the standard usage pattern), and no public exploit code has been identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
An unauthenticated NoSQL injection in Flowise before 3.1.4 lets remote attackers read other users' chat history by abusing the overrideConfig.sessionId parameter handled by the MongoDBMemory node. The parameter is passed into MongoDB queries without sanitization, so submitting MongoDB operator objects (e.g. $ne, $regex, $gt) through the prediction API causes the query to match records belonging to other users in the shared chat collection. Only confidentiality is affected (CVSS 4.0 base 8.7, VC:H, no integrity or availability impact); no CISA KEV listing, EPSS score, or public exploit code was provided at time of analysis, and vendor patch status is 'available' with version 3.1.4 as the fix.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.