CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

PT-2026-108109

Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...

CLSA-2026-1781830552 TuxCare security update for org.springframework.data:spring-data-r2dbc (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 1 CVE. Fixed in 1.5.18-tuxcare.2...

CLSA-2025-1754872136 TuxCare security update for org.springframework.data:spring-data-r2dbc (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 2 CVEs. Fixed in 1.5.18-tuxcare.1...

com.github.fmjsjx:libcommon-r2dbc (>=3.17.0-rc1, <=4.2.2), com.github.fmjsjx:libcommon-r2dbc-kotlin (>=3.17.0-rc1, <=4.2.2) +43 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-r2dbc MAVEN version =4.0.0, =3.17.0-rc1, =3.17.0-rc1, =4.1.0-rc, =8.0.1, =8.0.1, =10.0.1, =10.0.1, =0.1.0, =0.1.0, =0.13.0, =1.8.0, =1.5.0-beta2, =1.0.4, =4.0.0, =5.1.3 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

ch.nexsol-tech.gateway:sample-gateway (>=1.2.0, <=1.3.1), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=1.2.0, <=1.3.1) +71 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-r2dbc MAVEN version =3.5.0, =1.2.0, =1.2.0, =15.14-release, =3.14.0-rc1, =3.14.0-rc1, =7.0.0, =7.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +39 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.4.0, =0.0.1, =0.0.1, =3.11.0-rc1, =3.11.0-rc1, =6.0.0, =6.0.0, =0.6.0, =0.8.0 - io.eventuate.common:eventuate-common-spring-reactive-jdbc 0.21.0.release - io.eventuate.tram.core:eventuate-tram-reactive-consumer-jdbc 0.37.0.release -...

com.alcosi.nft:nft-api-gateway (>=15.0-release, <=15.12-release), com.google.cloud:spring-cloud-gcp-starter-sql-postgres-r2dbc (>=5.5.0, <=5.13.11) +29 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.3.0, =15.0-release, =5.5.0, =5.5.0, =9.0.8, =9.0.8, =0.1.0, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.16 and more Source cves: CVE-2026-41697htt...