CVE-2018-3754
SQL Injection in query-mysql
8.8
HIGH
CVSS 3.1
EPSS 0.24%
Description
All versions of `query-mysql` are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database. ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is passed into this module.
How to fix CVE-2018-3754
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- —no fix listed
Is CVE-2018-3754 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, <= 0.0.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |