SQL Injection

generator-jhipster is vulnerable to SQL Injection attacks. A remote attacker is able to inject malicious user input via the findAllBy function because the queries passed through criteria are not sanitized...

CVE-2022-24815

CVE-2022-24815 affects JHipster-generated applications that use a SQL database with reactive Spring WebFlux. The vulnerability resides in the entity repository’s findAllBy(Pageable, Criteria) where clause, where Criteria.toString() is not sanitized and user input is passed through directly, enabl...