Loading story…
A critical SQL injection flaw tracked as CVE-2026-69240 affects Sequelize when used with the Oracle database dialect, exposing applications that run versions prior to 6.37.4. The vulnerability lies in the ORM's sql-string.js escape logic, which fails to properly escape quotes when a supplied string begins with Oracle function names such as TO_DATE or TO_TIMESTAMP, causing attacker-controlled input to be inserted directly into generated SQL queries.
The issue is rated CVSS 9.8 and can be exploited remotely without authentication, potentially allowing attackers to bypass application controls, read sensitive data, alter or delete records, and execute arbitrary SQL expressions. Reports warn that in Oracle deployments with elevated database privileges, the impact could extend beyond the database to filesystem access or operating system command execution, creating a path to full host compromise. The vendor has released a fix in Sequelize 6.37.4 and advises affected users to upgrade immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The SQL injection vulnerability affecting Sequelize was assigned/disclosed as CVE-2026-69240, with the CVE record stating it was newly received by security-advisories@github.com. The disclosure references a GitHub Security Advisory for the issue.
Sequelize addressed an SQL injection flaw affecting its Oracle dialect handling in release 6.37.4. The fix corrected escaping behavior in sql-string.js for strings beginning with TO_TIMESTAMP or TO_DATE.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Drupal released security updates for **CVE-2026-9082**, a highly critical SQL injection flaw in Drupal core that affects websites using **PostgreSQL** databases. The vulnerability stems from improper neutralization of special characters in user input within Drupal's database API, allowing an unauthenticated remote attacker to send crafted requests that can trigger SQL injection. Successful exploitation could lead to **information disclosure**, **privilege escalation**, and in some environments potentially **remote code execution**. Drupal and downstream defenders urged administrators to upgrade to fixed versions **10.4.10**, **10.5.10**, **10.6.9**, **11.1.10**, **11.2.12**, or **11.3.10**, while manual patches were also issued for unsupported **8.9** and **9.5** branches; the flaw's severity was raised to **CVSS 9.8** after initial scoring understated the risk.
Jul 24, 2026
A critical SQL injection flaw tracked as **`CVE-2026-12076`** has been disclosed in **Raytha CMS**, with confirmed impact on version **1.5.2**. The vulnerability resides in the platform’s **OData filter parsing pipeline** and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying **PostgreSQL** database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data. The issue has been rated **CVSS 4.0 9.3 (Critical)** and is considered remotely exploitable. **CERT Polska** coordinated disclosure and credited **Arkadiusz Marta** for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
Jun 30, 2026
A security advisory disclosed an XML External Entity (XXE) injection flaw in Oracle Database tracked as **`CVE-2014-6577`**, exposing affected deployments to attacks that abuse XML parsing behavior. The issue was documented publicly by NetSPI, which identified the vulnerability as an Oracle Database weakness rather than an application-layer bug, raising concern for enterprises that rely on Oracle-backed services to process XML input. XXE vulnerabilities can allow attackers to force vulnerable parsers to access unintended local or remote resources, potentially leading to sensitive file disclosure, server-side request forgery, or other downstream compromise depending on configuration. Organizations using Oracle Database were urged to review exposure to **`CVE-2014-6577`**, assess XML-processing features in their environments, and apply Oracle security updates or mitigations where available.
Aug 15, 2026