Exposed
Monthly
SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.