CWE-564SQL Injection: Hibernate

Abstraction: Variant · CVEs in our corpus: 10

Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.

Last updated: 21 August 2026 14:15 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SI-10 Information Input Validation
SA-8 Security and Privacy Engineering Principles

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2025-0959`	6.5	8.8	0.0043	2025-03-07
`CVE-2025-8052`	6.5	8.8	0.0033	2025-10-20
`CVE-2026-40871`	6.3	7.2	0.0987	2026-04-21
`CVE-2024-48988`	5.9	7.6	0.0059	2025-08-22
`CVE-2024-58352`	5.9	7.5	0.0056	2026-07-02
`CVE-2026-4594`	5.6	7.3	0.0025	2026-03-23
`CVE-2026-4593`	4.8	6.3	0.0019	2026-03-23
`CVE-2025-67280`	4.2	5.4	0.0020	2026-01-09
`CVE-2026-22242`	4.0	4.9	0.0040	2026-01-08
`CVE-2026-23959`	4.0	4.9	0.0040	2026-01-22