Description
Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.
Remediation
References
https://github.com/knex/knex/issues/1227
https://nvd.nist.gov/vuln/detail/CVE-2016-20018
https://www.ghostccamm.com/blog/knex_sqli/
Related Vulnerabilities
CVE-2021-23443 Vulnerability in npm package edge.js
CVE-2022-25973 Vulnerability in npm package mc-kill-port
CVE-2023-49397 Vulnerability in maven package com.jfinal:jfinal
CVE-2021-36372 Vulnerability in maven package org.apache.ozone:ozone-common
CVE-2023-46660 Vulnerability in maven package org.jenkins-ci.plugins:zanata