cve.bz

CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input

Filter

The product uses Hibernate to execute a dynamic HQL or SQL statement, but the statement is built with user-controlled input.

What the weakness is: CWE-564 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 1
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-564, as MITRE names them. Credits.

Ask an AI about CWE-564

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/564.html and https://cve.bz/cve/cwe/564?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.0CVE-2026-111390EPSS 0.4%

    Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers ho…

  2. 4.4CVE-2026-73796EPSS 0.1%

    A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.

  3. 4.9CVE-2026-76451EPSS 0.4%

    A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability…

  4. 4.9CVE-2026-76450EPSS 0.4%

    A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability…

  5. 5.1CVE-2026-13337EPSS 0.3%

    CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.

  6. 8.7CVE-2024-58352EPSS 0.9%

    Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do …

  7. 7.2CVE-2026-40871EPSS 8.6%

    mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint …

  8. 5.5CVE-2026-4594EPSS 0.3%

    A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java. Such manipulation of the argument …

  9. 2.1CVE-2026-4593EPSS 0.2%

    A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai/call/impl/EruptDataQuery.java of the component MCP Tool Interface. This manipul…

  10. 6.9CVE-2026-23959EPSS 0.4%

    CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperl…

  11. 5.4CVE-2025-67280EPSS 0.2%

    In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.

  12. 4.9CVE-2026-22242EPSS 0.4%

    CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based…

  13. 1.0CVE-2025-8052EPSS 0.4%

    SQL Injection vulnerability in opentext Flipper allows SQL Injection.  The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor. This issue…

  14. 7.6CVE-2024-48988EPSS 0.6%

    SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. This vulnerability is present only in the distri…

  15. 6.5CVE-2025-0959EPSS 0.4%

    The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter a…