rewindex

RewindexCVEsConfluence

CVE-2026-0603: Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

High · CVSS 8.3 (CVSS 3.1)EPSS 1.0%, 64th percentilePublished Updated Assigner: redhat

Description

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · CWE-89

Tracked companies

Confluence

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Red Hat: Red Hat AMQ Broker 7Red Hat: Red Hat build of OptaPlanner 8Red Hat: Red Hat Data Grid 8Red Hat: Red Hat Fuse 7Red Hat: Red Hat JBoss Enterprise Application Platform 7Red Hat: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat: Red Hat JBoss Enterprise Application Platform 7.4.24Red Hat: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Red Hat: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8Red Hat: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9Red Hat: Red Hat JBoss Enterprise Application Platform 8Red Hat: Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat: Red Hat OpenShift AI (RHOAI)Red Hat: Red Hat OpenShift Dev SpacesRed Hat: Red Hat Process Automation 7Red Hat: Red Hat Satellite 6Red Hat: Red Hat Single Sign-On 7Red Hat: Red Hat Single Sign-On 7.6.13Red Hat: Red Hat Single Sign-On 7.6 for RHEL 7Red Hat: Red Hat Single Sign-On 7.6 for RHEL 8Red Hat: Red Hat Single Sign-On 7.6 for RHEL 9Red Hat: RHEL-8 based Middleware Containers

References

All CVEsMarkdownJSON