In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete a…
CVSS 3.1MEDIUM 5.9·Network·Low privileges·No interaction·EPSS 0.00763·Published 2020-06-03·Fixed in 0.15.1, 0.16.2CWE-89