Common Weakness Enumeration
CWE-564 SQL Injection: Hibernate
Description
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-564 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-9c4c-g95m-c8cp | CVE-2025-71332 | MODERATE |
FlowiseDB vulnerable to SQL Injection by authenticated users |
2026-06-24 | |
| GHSA-fqcv-8859-86x2 | CVE-2026-23959 | MODERATE | - |
CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier |
2026-01-22 |
| GHSA-ch7p-mpv4-4vg4 | CVE-2026-22242 | MODERATE | - |
CoreShop Vulnerable to SQL Injection via Admin Reports |
2026-01-12 |
| GHSA-q53r-9hh9-w277 | CVE-2024-11956 | MODERATE | - |
pimcore/customer-data-framework vulnerable to SQL Injection |
2025-01-28 |