Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.hibernate/hibernate-core@5.3.20.Final
purl pkg:maven/org.hibernate/hibernate-core@5.3.20.Final
Next non-vulnerable version 6.0.0.Alpha2
Latest non-vulnerable version 6.0.0.Alpha2
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-qqu7-yqc6-rqab
Aliases:
CVE-2026-0603
GHSA-2p5w-cvg5-gc5c
org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection
6.0.0.Alpha2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-vdv3-7dwp-suab SQL injection in hibernate-core A flaw was found in hibernate-core in versions prior to 5.3.20.Final and in 5.4.0.Final up to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity. CVE-2020-25638
GHSA-j8jw-g6fq-mp7h

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-19T17:39:50.717462+00:00 GitLab Importer Affected by VCID-qqu7-yqc6-rqab https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.hibernate/hibernate-core/CVE-2026-0603.yml 38.4.0
2026-04-16T21:14:39.061441+00:00 GitLab Importer Fixing VCID-vdv3-7dwp-suab https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.hibernate/hibernate-core/CVE-2020-25638.yml 38.4.0
2026-04-11T22:26:45.903144+00:00 GitLab Importer Fixing VCID-vdv3-7dwp-suab https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.hibernate/hibernate-core/CVE-2020-25638.yml 38.3.0
2026-04-02T22:38:29.974896+00:00 GitLab Importer Fixing VCID-vdv3-7dwp-suab https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.hibernate/hibernate-core/CVE-2020-25638.yml 38.1.0
2026-04-01T16:55:55.070751+00:00 GitLab Importer Fixing VCID-vdv3-7dwp-suab https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.hibernate/hibernate-core/CVE-2020-25638.yml 38.0.0
2026-04-01T15:59:33.837073+00:00 GHSA Importer Fixing VCID-vdv3-7dwp-suab https://github.com/advisories/GHSA-j8jw-g6fq-mp7h 38.0.0
2026-04-01T13:06:37.081374+00:00 GithubOSV Importer Fixing VCID-vdv3-7dwp-suab https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-j8jw-g6fq-mp7h/GHSA-j8jw-g6fq-mp7h.json 38.0.0