CVE-2016-10553
Quick assessment
Affected
HackerOne sequelize node module
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
sequelize是一个用于Node.js的数据库ORM（对象关系映射）工具。 sequelize 2.1.3及之前版本中存在SQL注入漏洞。远程攻击者可利用该漏洞执行任意的SQL命令。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-10553
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
sequalize SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
sequelize是一个用于Node.js的数据库ORM（对象关系映射）工具。 sequelize 2.1.3及之前版本中存在SQL注入漏洞。远程攻击者可利用该漏洞执行任意的SQL命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HackerOne | sequelize node module | <= 2.1.3 | - |
|
II. Public POCs for CVE-2016-10553
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-10553
请登录查看更多情报信息。
Other References for CVE-2016-10553 (2)
-
https://nodesecurity.io/advisories/109 x_refsource_MISC
-
https://github.com/sequelize/sequelize/blob/master/changelog.md#300 x_refsource_MISC
Same Patch Batch · HackerOne · 2018-05-31 · 50 CVEs total
| CVE-2016-10549 | Sails 安全漏洞 | |
| CVE-2016-10560 | galenframework-cli 安全漏洞 | |
| CVE-2016-10564 | apk-parser 安全漏洞 | |
| CVE-2016-10565 | operadriver 安全漏洞 | |
| CVE-2016-10569 | embedza 安全漏洞 | |
| CVE-2016-10571 | bkjs-wand 安全漏洞 | |
| CVE-2016-10572 | mongodb-instance 安全漏洞 | |
| CVE-2016-10563 | go-ipfs-deps模块安全漏洞 | |
| CVE-2016-10552 | igniteui 安全漏洞 | |
| CVE-2016-10550 | sequalize SQL注入漏洞 | |
| CVE-2016-10554 | sequelize 安全漏洞 | |
| CVE-2016-10548 | reduce-css-calc node模块安全漏洞 | |
| CVE-2016-10547 | Nunjucks 安全漏洞 | |
| CVE-2016-10546 | PouchDB 安全漏洞 | |
| CVE-2016-10544 | uws 安全漏洞 | |
| CVE-2016-10543 | call 安全漏洞 | |
| CVE-2016-10542 | ws 安全漏洞 | |
| CVE-2016-10541 | Thshell-quote 安全漏洞 | |
| CVE-2016-10540 | Minimatch 安全漏洞 | |
| CVE-2016-10539 | negotiator 安全漏洞 |
Showing top 20 of 50 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-89
-
CVE-2026-76270
Structured Query Language (SQL) Injection in the SPL2 Module -
CVE-2026-95605
WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vu -
CVE-2026-76452
Cisco Smart Software Manager On-Prem SQL Injection Vulnerabi -
CVE-2026-62251
Homer: Authenticated SQL Injection via Unvalidated rawquery -
CVE-2026-42708
WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vul
V. Comments for CVE-2016-10553
No comments yet