Jhipster vulnerabilities

Products

• Generator-jhipster 3
• Jhipster 3

Newest

• jhipster generator-jhipster JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort CVE-2026-107375 Fix available 8.8 HighOctober 8, 2026
• jhipster generator-jhipster, react-jhipster +1 more JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob CVE-2026-107303 Fix available 7.6 HighOctober 8, 2026
• jhipster Withdrawn Advisory: JHipster allows privilege escalation via a modified authorities parameter CVE-2025-43712 Disputed 2.9 LowJuly 25, 2025
• jhipster generator-jhipster-entity-audit CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework CVE-2025-31119 Fix available 7.7 HighApril 3, 2025
• jhipster generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character CVE-2015-20110 Fix available 7.5 HighOctober 31, 2023
• jhipster generator-jhipster SQL Injection when creating an application with Reactive SQL backend CVE-2022-24815 Fix available 8.1 HighApril 7, 2022
• jhipster generator-jhipster-kotlin, jhipster-kotlin +1 more Log Forging in generator-jhipster-kotlin CVE-2020-4072 Fix available 5.3 MediumJune 25, 2020
• jhipster, jhipster kotlin +1 more JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0 CVE-2019-16303 Fix available 9.8 CriticalSeptember 13, 2019