NetBotz SQLi via Hibernate HQL on Web UI/Service
CVE-2026-13337 Published on September 1, 2026

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.

NVD

Vulnerability Analysis

Attack Vector:
ADJACENT
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

SQL Injection: Hibernate

Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.


Affected Versions

Schneider Electric NetBotz 5 - 750/755 Version Versions 5.5.2 and prior is affected by CVE-2026-13337