CVE-2026-82045 — UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPrope…
Published: 2026-10-02 · CVSS: 7.1 · CVSS 4.0
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues(), which builds a JPQL query with String.format() and executes it via em.createQuery() without parameter binding. Attackers can inject malicious JPQL through the value parameter in the GET /api/utm-network-scans/searchPropertyValues endpoint to extract sensitive data including credential tables such as jhi_user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7