CWE-564 · SQL Injection
Use of Hibernate with HQL/SQL Query String Containing External Input
14CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
14 CVEs with CWE-564 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-58352Landray OA Unauthenticated HQL Injection via wechatLoginHelper.doShenzhen Landray Software Co., Ltd. · Landry Office Automation (OA) · CVSS 7.5 · 2026-07-02 | 7.5 | 0.9% | 2026-07-02 |
| CVE-2024-48988Apache StreamPark: SQL injection vulnerabilityApache Software Foundation · Apache StreamPark · CVSS 7.6 · 2025-08-22 | 7.6 | 0.6% | 2025-08-22 |
| CVE-2025-0959Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_idimithemes · Eventer - WordPress Event & Booking Manager Plugin · CVSS 8.8 · 2025-03-07 | 8.8 | 0.4% | 2025-03-07 |
| CVE-2026-76451Cisco Identity Services Engine Certificate Management SQL Injection VulnerabilityCisco · Cisco Identity Services Engine Software · CVSS 4.9 · 2026-09-16 | 4.9 | 0.4% | 2026-09-16 |
| CVE-2026-76450Cisco Identity Services Engine SQL Injection VulnerabilityCisco · Cisco Identity Services Engine Software · CVSS 4.9 · 2026-09-16 | 4.9 | 0.4% | 2026-09-16 |
| CVE-2026-22242CoreShop Vulnerable to SQL Injection via Admin Reportscoreshop · CoreShop · CVSS 4.9 · 2026-01-08 | 4.9 | 0.4% | 2026-01-08 |
| CVE-2026-23959CoreShop Vulnerable to SQL Injection via Admin customer-company-modifiercoreshop · CoreShop · CVSS 6.9 · 2026-01-22 | 6.9 | 0.4% | 2026-01-22 |
| CVE-2025-8052HQL Injection vulnerability has been discovered in Opentext Flipper.opentext · Flipper · CVSS 1 · 2025-10-20 | 1.0 | 0.4% | 2025-10-20 |
| CVE-2026-111390Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table APIerupts · erupt · CVSS 5.3 · 2026-10-16 | 5.3 | 0.4% | 2026-10-16 |
| CVE-2026-13337CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the Net…Schneider Electric · NetBotz 5 - 750/755 · CVSS 5.1 · 2026-09-01 | 5.1 | 0.3% | 2026-09-01 |
| CVE-2026-4594erupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injectionerupts · erupt · CVSS 7.3 · 2026-03-23 | 7.3 | 0.3% | 2026-03-23 |
| CVE-2025-67280In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users an…Tim-Solutions · Tim Flow · CVSS 5.4 · 2026-01-09 | 5.4 | 0.2% | 2026-01-09 |
| CVE-2026-4593erupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injectionerupts · erupt · CVSS 6.3 · 2026-03-23 | 6.3 | 0.2% | 2026-03-23 |
| CVE-2026-73796HPE NonStop TSQLEXE - Memory Corruption vulnerabilityHewlett Packard Enterprise · HPE NonStop TSQLEXE · CVSS 4.4 · 2026-10-14 | 4.4 | 0.1% | 2026-10-14 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.