CVE-2016-10556

CVE-2016-10556 describes a SQL injection vulnerability in sequelize versions 3.19.3 and earlier, affecting its Object-Relational Mapping (ORM) when used with Postgres, SQLite, and Microsoft SQL Server. The flaw arises from improper escaping of array inputs, where arrays are treated as strings, allowing a malicious user to inject arbitrary SQL commands. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity that can lead to high impact on availability, such as data deletion. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.