CVE-2016-0710

CVE-2016-0710 describes multiple SQL injection vulnerabilities in the User Manager service of Apache Jetspeed versions prior to 2.3.1. Attackers can exploit these flaws by manipulating the 'role' or 'user' parameters in requests to services/usermanager/users/, enabling arbitrary SQL command execution. This vulnerability carries a CVSSv3 score of 8.8 (HIGH), indicating a network-exploitable flaw with low attack complexity, requiring only low privileges, and leading to high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, its high EPSS score suggests a significant likelihood of exploitation, and exploit code for a related arbitrary file upload vulnerability exists in Metasploit, though direct SQLi exploit code is not explicitly mentioned.