EUVD-2026-91801

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

PT-2026-104447

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the UtmNetworkScanService.searchPropertyValues function, which constructs a...