CVE-2026-69240

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

August 4, 2026

Last Seen

August 4, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical SQL Injection Vulnerability in Sequelize ORM Affects Oracle Users72.9

CVE-2026-69240 is a critical SQL injection vulnerability affecting Sequelize ORM when configured for Oracle databases. The flaw, rated 9.8 on the CVSS scale, allows attackers to inject arbitrary SQL expressions through specially crafted input starting with 'TO_TIMESTAMP' or 'TO_DATE'. The escape fun...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical SQL Injection Vulnerability in Sequelize ORM Affects Oracle Users

Aug 4·2 sources

Related Articles (2)

CVE-2026-69240 AKAOMA CVE VULNERABILITIES / 1h Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an app

cve.akaoma.com·Aug 4

CVE-2026-69240 - Exploits & Severity

Related Entities

Sql Injection Oracle Cwe-89 - SQL Injection T1190 - Exploit Public-Facing Application Node.js