CVE-2016-6652

CVE-2016-6652 is a SQL injection vulnerability affecting Pivotal Spring Data JPA versions prior to 1.9.6 (Gosling SR6) and 1.10.x prior to 1.10.4 (Hopper SR4). This flaw allows attackers to execute arbitrary JPQL commands by manipulating a sort instance with a function call when a repository uses a String query with the @Query annotation. Rated as Medium severity (CVSS 5.6), it has a network-based attack vector with high attack complexity, potentially leading to limited confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.