Cypher injection (Neo4j)

When it applies

An app builds a Neo4j Cypher query by concatenating user input — a login (MATCH (u {name:'<in>', pass:'<in>'})), a search, or a filter. Like SQLi, mixing input into the query language lets you change its meaning: bypass auth, read arbitrary nodes, or pivot to SSRF/RCE via Cypher's data-loading and (mis)installed apoc procedures.

Why it works

Cypher is a query language with the same code/data confusion as SQL, plus graph-specific power: UNION across labels, LOAD CSV FROM <url> (server-side fetch = SSRF), and — if apoc is present and permissive — apoc.load.* / dbms.* that can reach the network or the OS.