Monthly
Authenticated HQL injection in Erupt through version 2.3.0 lets a user who already holds query permission on an entity with a String-keyed linkTree target escape that entity's tree-scoped data filter and read records belonging to other mapped entities. The flaw is reached by posting unescaped quote characters into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, which allows attackers to append always-true OR clauses or boolean subqueries to the generated Hibernate query. Exploitation is not trivial: it depends on valid low-privileged credentials plus a specific data-model configuration (a String-keyed linkTree target with query permission), and the impact is limited to confidentiality - no write or availability effect - so this is best treated as a moderate-priority authorization/data-exposure issue, and no public exploit code has been identified at time of analysis.
Application crashes in the HPE NonStop TSQLEXE SQL execution component can be triggered by a crafted SQL query submitted by an authenticated, low-privileged user who already has local access to the system, producing availability loss for that component. The assessed severity is deliberately low (CVSS 3.1 base 4.4; AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L): there is no confidentiality or integrity impact, no victim interaction, and no evidence of a remote, unauthenticated path or of code execution. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS signal is unavailable in the supplied intelligence.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Erupt up to version 1.13.3 allows unauthenticated remote attackers to execute arbitrary SQL queries through the sort.field parameter in the HQL query builder. Public exploit code exists for this vulnerability, and no patch is currently available. Affected Java applications using vulnerable versions of Erupt are at risk of data exfiltration and manipulation.
SQL injection in Erupt's MCP Tool Interface allows authenticated attackers to manipulate database queries through the EruptDataQuery component, potentially exposing or modifying sensitive data. The vulnerability affects Java-based Erupt deployments version 1.13.3 and has public exploit code available. No patch is currently available from the vendor, who has not responded to disclosure efforts.
Improper input sanitization in CoreShop's CustomerTransformerController prior to version 4.1.9 allows authenticated administrators to inject SQL commands through the admin panel, enabling database error-based information disclosure. An attacker with high-privilege access can exploit this to extract sensitive data from the underlying database without modifying or deleting records. A patch is available in version 4.1.9 and later.
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user. [CVSS 5.4 MEDIUM]
Authenticated HQL injection in Erupt through version 2.3.0 lets a user who already holds query permission on an entity with a String-keyed linkTree target escape that entity's tree-scoped data filter and read records belonging to other mapped entities. The flaw is reached by posting unescaped quote characters into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, which allows attackers to append always-true OR clauses or boolean subqueries to the generated Hibernate query. Exploitation is not trivial: it depends on valid low-privileged credentials plus a specific data-model configuration (a String-keyed linkTree target with query permission), and the impact is limited to confidentiality - no write or availability effect - so this is best treated as a moderate-priority authorization/data-exposure issue, and no public exploit code has been identified at time of analysis.
Application crashes in the HPE NonStop TSQLEXE SQL execution component can be triggered by a crafted SQL query submitted by an authenticated, low-privileged user who already has local access to the system, producing availability loss for that component. The assessed severity is deliberately low (CVSS 3.1 base 4.4; AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L): there is no confidentiality or integrity impact, no victim interaction, and no evidence of a remote, unauthenticated path or of code execution. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS signal is unavailable in the supplied intelligence.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in Erupt up to version 1.13.3 allows unauthenticated remote attackers to execute arbitrary SQL queries through the sort.field parameter in the HQL query builder. Public exploit code exists for this vulnerability, and no patch is currently available. Affected Java applications using vulnerable versions of Erupt are at risk of data exfiltration and manipulation.
SQL injection in Erupt's MCP Tool Interface allows authenticated attackers to manipulate database queries through the EruptDataQuery component, potentially exposing or modifying sensitive data. The vulnerability affects Java-based Erupt deployments version 1.13.3 and has public exploit code available. No patch is currently available from the vendor, who has not responded to disclosure efforts.
Improper input sanitization in CoreShop's CustomerTransformerController prior to version 4.1.9 allows authenticated administrators to inject SQL commands through the admin panel, enabling database error-based information disclosure. An attacker with high-privilege access can exploit this to extract sensitive data from the underlying database without modifying or deleting records. A patch is available in version 4.1.9 and later.
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user. [CVSS 5.4 MEDIUM]