← Vulnerability feed

Vulnerability record · CVE-2016-4999 · published 5 August 2016

CVE-2016-4999: Redhat dashbuilder sql injection vulnerability

Redhat · Dashbuilder

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

9.8 CVSS 3.1 Critical EPSS 3.7% · top 10.7% CWE-89 · SQL injection
9.8CVSS 3.1 base score, v2 7.5
3.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/91795 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2016:1428 Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990 Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b Third Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113 Permissions Required
http://www.securityfocus.com/bid/91795 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2016:1428 Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990 Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b Third Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113 Permissions Required

Track CVE-2016-4999 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-19361Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from po…EPSS 11%9.8CVE-2018-19362Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core cla…EPSS 11%9.8CVE-2018-19360Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms c…EPSS 11%9.8CVE-2015-7501Red Hat JBoss Java deserialization allows remote command executionMultiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to exe…EPSS 86%analysed8.8CVE-2016-5401Redhat jboss bpm suite cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for re…EPSS 0.63%8.8CVE-2016-7034Redhat jboss bpm suite cross-site request forgery vulnerabilityThe dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query s…EPSS 1.1%7.5CVE-2015-1818Redhat jboss bpm suite vulnerabilityXML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red …EPSS 2.2%7.5CVE-2013-2186Redhat jboss enterprise brms platform improper input validation vulnerabilityThe DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss …EPSS 13%

Source: NIST National Vulnerability Database (record CVE-2016-4999), CISA KEV, FIRST EPSS (scores of 2026-10-12). This page is refreshed as NVD updates the record.