CVE-2022-38488 - logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter

CRITICAL

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter

Published Dec 14, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 14.24%

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

Link	Providers	Tags
https://archive.ph/PecmD		Third Party Advisory
https://archive.ph/VlGDa		Technical DescriptionThird Party Advisory
https://blog.logrocket.com/implement-oauth-2-0-node-js/		ProductTechnical DescriptionVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41071		Advisory
https://github.com/diogosouza/logrocket-oauth2-example		Broken Link
https://github.com/secoats/cve/tree/master/CVE-2022-38488_sqli_logrocket-oauth2-example		ExploitThird Party Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 14, 2022

Updated Apr 22, 2025

Reserved Aug 20, 2022

CISA Vulnrichment

Updated Apr 22, 2025

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 14, 2022

Updated Apr 22, 2025

GitHub

No data