SQL Injection

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret.CVE-2022-32211Rocket.chat · CVSS 8.8 · 1.4% likely

   CWE-891 bounty report

2. A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least on…CVE-2023-28359Rocket.chat · CVSS 5.3 · 0.6% likely

   CWE-891 bounty report

3. Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATOCVE-2026-45689RocketChat · CVSS 9.1 · 0.5% likely

   CWE-943

4. Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session HijackCVE-2026-45688RocketChat · CVSS 9.1 · 0.5% likely

   CWE-943

5. In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a genera…CVE-2026-29198Rocket.Chat · CVSS 9.8 · 0.4% likely

   CWE-891 bounty report

6. Rocket.Chat: NoSQL injection in the EE ddp-streamer-serviceCVE-2026-30833RocketChat · CVSS 6.9 · 0.3% likely

   CWE-943

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.