Mybatis

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Mybatis records in CISA KEV

No Mybatis vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records

TI-2023-10708 CVE-2023-25330 · GHSA-32qq-m9fh-f74w

HIGH 82

A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0121 Published 2023-04-05 Fixed in 3.5.3.1 CWE-89

TI-2022-16899 CVE-2022-36594 · GHSA-7mpq-hfgq-f4jg

MEDIUM 44

Mapper v4.0.0 to v4.2.0 was discovered to contain a SQL injection vulnerability via the ids parameter at the selectByIds function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00921 Published 2022-09-02 No fix listed CWE-89

TI-2020-16370 CVE-2020-26945 · GHSA-qq48-m4jx-xqh8

LOW 39

MyBatis before 3.5.6 mishandles deserialization of object streams.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0182 Published 2020-10-10 Partial fix · 3.5.6 CWE-502