CVE-2026-0603

HighCVSS 8.3/10Last modified Oct 6, 2026

Description

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-06046.5The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and inclu CVE-2026-06059.8A security vulnerability has been detected in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionalit CVE-2026-06069.8A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Front CVE-2026-06079.8A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminViewSongs.php CVE-2026-06086.4The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all version CVE-2026-06096.4The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-06109.8SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 CVE-2026-06119.8Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerabi CVE-2026-06127.5The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external co CVE-2026-06137.5The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behav CVE-2026-06157.3The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within The CVE-2026-06167.5TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into the internal TheLibra