CVE-2026-4594 describes a high-severity SQL injection vulnerability in erupts erupt up to version 1.13.3, specifically located in the `geneEruptHqlOrderBy` function within `EruptJpaUtils.java` due to improper handling of the `sort.field` argument. Rated 7.3 HIGH on the CVSS scale, this flaw allows an unauthenticated attacker to remotely execute SQL injection attacks via Hibernate with low attack complexity, potentially compromising data confidentiality, integrity, and system availability. Although exploit details have been publicly disclosed, there is currently no evidence of active exploitation, nor are there known exploits available in common frameworks, and community discussion remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Erupts | Erupt | 1.13.0, 1.13.1, 1.13.2, 1.13.3CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.