CWE-564: HQL Injection
The product uses Hibernate to execute a dynamic HQL or SQL statement, but the statement is built with user-controlled input.
Also known as Use of Hibernate with HQL/SQL Query String Containing External Input.
A kind of CWE-89 SQL Injection.
From the CWE List. © The MITRE Corporation.
Newest
- erupts erupt Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API 6.0 Medium
- hewlett packard enterprise hpe nonstop tsqlexe HPE NonStop TSQLEXE - Memory Corruption vulnerability 4.4 Medium
- cisco ise passive identity connector, identity services engine, identity services engine software +1 more +3 more Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability 4.9 Medium
- cisco ise passive identity connector, identity services engine, identity services engine software +1 more +3 more Cisco Identity Services Engine SQL Injection Vulnerability 4.9 Medium
- schneider electric netbotz 5 - 750/755 CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a... 5.1 Medium
- shenzhen landray software co., ltd. landry office automation (oa) Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do 8.7 High
- mailcow mailcow-dockerized mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API 7.2 High
- erupts erupt erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injection 6.9 Medium
- erupts erupt erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection 5.3 Medium
- coreshop CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier 6.9 Medium
- tim-solutions tim flow In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection... 5.4 Medium
- coreshop CoreShop Vulnerable to SQL Injection via Admin Reports 4.9 Medium
- opentext flipper HQL Injection vulnerability has been discovered in Opentext Flipper. 1.0 Low
- apache streampark Apache StreamPark: SQL injection vulnerability 7.6 High
- flowise Flowise - SQL Injection in importChatflows API via chatflow.id Parameter 8.5 High
- imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id 8.8 High
- pimcore customer-data-framework, pimcore +1 more Pimcore customer-data-framework list sql injection 5.1 Medium
- te informatics nova cms SQLi in TE Informatics' Nova CMS 6.9 Medium