K000162894: Spring Data Relational vulnerability CVE-2026-41697

Security Advisory Description Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational [CVE-2026-41697]

Summary IBM Watson Speech Services Cartridge is vulnerable to data inference in Spring Data Relational, due to a failure to properly escape binding values of externally-controlled input hat can allow an attacker can supply wildcard characters CVE-2026-41697. Spring Data Relational, is used as par...

CVE-2026-41697

A flaw was found in Spring Data Relational. This vulnerability allows a remote attacker to perform boolean-based blind data inference by supplying wildcard characters in externally-controlled input when using StringMatcher in Query By Example QBE. This can lead to the disclosure of sensitive...

CVE-2026-41697 Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

CVE-2025-41697

creationtimestamp| type| source ---|---|--- 2025-12-09 07:58:11+00:00| seen| https://infosec.exchange/users/certvde/statuses/115688544042508118 2025-12-09 11:41:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7khlisvzr2n 2025-12-18 14:29:08+00:00| seen|...

EUVD-2025-41697

Malicious code in andi-getuk96-sukiwir npm...

CVE-2023-41697

Cross-Site Request Forgery CSRF vulnerability in Nikunj Soni Easy WP Cleaner plugin = 1.9 versions...

CVE-2021-41697

A reflected Cross Site Scripting XSS vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerrordescription parameter in assets/sources/instagram.php script...

CVE-2024-41697

creationtimestamp| type| source ---|---|--- 2024-08-20 14:37:02+00:00| seen| https://t.me/cvedetector/3614...

CVE-2024-41697

Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-41697

Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-41697 Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-41697: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2023-41697

creationtimestamp| type| source ---|---|--- 2023-10-10 12:30:04+00:00| seen| https://t.me/cibsecurity/71901...

CVE-2023-41697

Cross-Site Request Forgery CSRF vulnerability in Nikunj Soni Easy WP Cleaner plugin = 1.9 versions...

CVE-2023-41697

CVE-2023-41697: CSRF in Easy WP Cleaner plugin for WordPress (versions <= 1.9). Exploitation requires no privileges and is unauthenticated; CSRF could enable unintended actions on affected sites. Connected sources confirm the issue as CSRF and indicate versions

WordPress Easy WP Cleaner Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy WP Cleaner Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41697 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 515d5d148a8d Credits Mika Required privilege...

CVE-2022-41697

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability...

CVE-2022-41697

CVE-2022-41697 affects Ghost CMS 5.9.4, where the login flow returns distinct error messages that allow attacker-driven user enumeration. The Nuclei template and related sources confirm a vulnerability in Ghost’s authentication, enabling an attacker to determine valid usernames/emails via special...

CVE-2022-41697

creationtimestamp| type| source ---|---|--- 2022-12-22 12:13:32+00:00| seen| https://t.me/cibsecurity/55107 2026-01-20 14:01:28+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-41697.yaml 2026-01-21 21:03:00+00:00| seen|...