Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
A flaw was found in Hibernate ORM Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.