TI-2025-28302 CVE-2025-43712
Improper access control in JHipster
Priority HIGH 70
JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter.
jhipster
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
jhipster records in CISA KEVNo jhipster vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2022-08628 CVE-2022-24815 · GHSA-qjmq-8hjr-qcv6
SQL Injection when creating an application with Reactive SQL backend
Priority HIGH 70
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures.
TI-2025-22380 CVE-2025-31119 · GHSA-7rmp-3g9f-cvq8
CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework
Priority HIGH 69
generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page.
TI-2026-69607 CVE-2026-107303 · GHSA-9ffp-22j7-56r2
Stored cross-site scripting in JHipster generated applications
Priority HIGH 66
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures.
TI-2019-12273 CVE-2019-16303 · GHSA-j3rh-8vwq-wh84
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through…
Priority MEDIUM 48
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils).
TI-2026-69614 CVE-2026-107375 · GHSA-r223-96jv-q533
SQL injection in JHipster reactive applications via sort parameter
Priority MEDIUM 40
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures.
TI-2015-08085 CVE-2015-20110 · GHSA-4gpm-r23h-gprw
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken…
Priority MEDIUM 40
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different.
TI-2020-03553 CVE-2020-4072 · GHSA-pfxf-wh96-fvjc
Log Forging in generator-jhipster-kotlin
Priority LOW 26
In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts.