SQL Injection

Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection via the...

SQL Injection

Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection via the sor...

org.apache.syncope.core:syncope-core-logic (2.0.0-m2), org.apache.syncope.core:syncope-core-persistence-jpa (2.0.0-m2) +7 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (2.0.0-m2)

org.apache.syncope.core:syncope-core-spring MAVEN version 2.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope.core:syncope-core-spring and may be impacted: - org.apache.syncope.core:syncope-core-logic 2.0.0-m2 -...

org.apache.syncope.core:syncope-core-logic (2.0.2), org.apache.syncope.core:syncope-core-migration (2.0.2) +8 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (2.0.2)

org.apache.syncope.core:syncope-core-spring MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope.core:syncope-core-spring and may be impacted: - org.apache.syncope.core:syncope-core-logic 2.0.2 -...

org.apache.syncope.core:syncope-core-logic (2.0.7), org.apache.syncope.core:syncope-core-migration (2.0.7) +20 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (2.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope.core:syncope-core-spring and may be impacted: - org.apache.syncope.core:syncope-core-logic 2.0.7 -...

org.apache.syncope.core:syncope-core-persistence-jpa (2.1.8), org.apache.syncope.core:syncope-core-persistence-jpa-json (2.1.8) +12 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (2.1.8)

org.apache.syncope.core:syncope-core-spring MAVEN version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope.core:syncope-core-spring and may be impacted: - org.apache.syncope.core:syncope-core-persistence-jpa 2.1.8 -...

org.apache.syncope.core:syncope-core-persistence-jpa (2.1.7), org.apache.syncope.core:syncope-core-persistence-jpa-json (2.1.7) +12 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (2.1.7)

org.apache.syncope.core:syncope-core-spring MAVEN version 2.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope.core:syncope-core-spring and may be impacted: - org.apache.syncope.core:syncope-core-persistence-jpa 2.1.7 -...

Cross-site Scripting (XSS)

syncope-core-persistence-jpa is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on Connector names, Report names, and AnyTypeClass keys, allowing persistent XSS attacks...