CVE-2016-6652

SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.

• CWE-89

• http://www.securityfocus.com/bid/93276
• https://github.com/spring-projects/spring-data-jpa/commit/b8e7fePatch
• https://jira.spring.io/browse/DATAJPA-965Mitigation, Vendor Advisory
• https://pivotal.io/security/cve-2016-6652Vendor Advisory
• https://security.gentoo.org/glsa/201701-01
• http://www.securityfocus.com/bid/93276
• https://github.com/spring-projects/spring-data-jpa/commit/b8e7fePatch
• https://jira.spring.io/browse/DATAJPA-965Mitigation, Vendor Advisory
• https://pivotal.io/security/cve-2016-6652Vendor Advisory
• https://security.gentoo.org/glsa/201701-01

Published

Oct 5, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6646The vApp Managers web application in EMC Unisphere for VMAX …
• CVE-2016-6647Cross-site scripting (XSS) vulnerability in EMC ViPR SRM bef…
• CVE-2016-6648EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoin…4.4
• CVE-2016-6649EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoin…6.7
• CVE-2016-6650EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint …7.5
• CVE-2016-6651The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF)…
• CVE-2016-6653The MariaDB audit_plugin component in Pivotal Cloud Foundry …
• CVE-2016-6654Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6655An issue was discovered in Cloud Foundry Foundation Cloud Fo…
• CVE-2016-6656An issue was discovered in Pivotal Greenplum before 4.3.10.0…
• CVE-2016-6657An open redirect vulnerability has been detected with some P…
• CVE-2016-6658Applications in cf-release before 245 can be configured and …