View all vulnerabilities

CVE-2016-20018

Knex.js has a limited SQL injection vulnerability

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. This vulnerability has been fixed in version 2.4.0.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
knex < 2.4.0
Severity
High
Ecosystem
JavaScript
Publish Date
December 19, 2022
Modified Date
November 7, 2023