Mybatis-plus <3.5.3.1 SQLi via tenant ID value
CVE-2023-25330 Published on April 5, 2023
A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.
Products Associated with CVE-2023-25330
Want to know whenever a new CVE is published for Mybatis? stack.watch will email you.
Exploit Probability
EPSS
0.90%
Percentile
76.04%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.