CWE-943 Improper Neutralization of Special Elements in Data Query Logic

LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost: Invite Token Disclosure in Ghost Admin API

Ghost: Authorization Bypass in Comments Feature

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Duplicate Advisory: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Duplicate Advisory: GridFS data disclosure and deletion via query-operator injection in file IDs

mongodb: Reject "." and NUL bytes in database and collection names

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Budibase has nonymous NoSQL operator injection via published-app query templates

Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

ShellHub has crash-DoS via field injection in filter and sort-by parameters