Skip to content
Threat Feed
high advisory

Erupt Framework SQL Injection Vulnerability (CVE-2026-4594)

A SQL injection vulnerability (CVE-2026-4594) exists in erupts erupt up to version 1.13.3, allowing remote attackers to execute arbitrary SQL commands by manipulating the sort.field argument in the geneEruptHqlOrderBy function.

A SQL injection vulnerability, identified as CVE-2026-4594, has been discovered in the erupts erupt framework, affecting versions up to 1.13.3. The vulnerability resides within the geneEruptHqlOrderBy function in the erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java file. Attackers can remotely exploit this flaw by manipulating the sort.field argument, leading to arbitrary SQL command execution within the Hibernate framework. Public exploit code is available…

Detection coverage 2

Detect SQL Injection Attempts in Erupt Framework via sort.field

high

Detects potential SQL injection attempts in the Erupt framework by monitoring HTTP requests with suspicious SQL syntax in the sort.field parameter.

sigma tactics: execution techniques: T1190 sources: webserver, linux

Detect Erupt Framework SQL Injection - Hibernate Specific Keywords

high

Detects SQL injection attempts targeting Erupt framework by looking for hibernate specific keywords

sigma tactics: execution techniques: T1190 sources: webserver, linux

Detection queries are kept inside the platform. Get full rules →