Sequelize (Sequelizejs) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 663 known versions, newest CVE from 2026-03-10. Vendor: Sequelizejs.
CVEs of Sequelize
- CVE-2026-30951 - CVSS 7.5 (high), 2026-03-10: Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON()…
- CVE-2023-25813 - CVSS 10 (critical), 2023-02-22: Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through…
- CVE-2023-22578 - CVSS 10 (critical), 2023-02-16: Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
- CVE-2023-22580 - CVSS 7.5 (high), 2023-02-16: Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.
- CVE-2023-22579 - CVSS 9.9 (critical), 2023-02-16: Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.
- CVE-2019-10749 - CVSS 9.8 (critical), 2019-10-29: sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
- CVE-2019-10748 - CVSS 9.8 (critical), 2019-10-29: Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the…
- CVE-2019-10752 - CVSS 9.8 (critical), 2019-10-17: Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values…
- CVE-2019-11069 - CVSS 7.5 (high), 2019-04-10: Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
- CVE-2016-10554 - CVSS 9.8 (critical), 2018-05-31: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data…
- CVE-2016-10553 - CVSS 9.8 (critical), 2018-05-31: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data…
- CVE-2016-10550 - CVSS 9.8 (critical), 2018-05-31: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data…
- CVE-2016-10556 - CVSS 7.5 (high), 2018-05-29: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data…
