UTMStack versions older than 11.2.16 contain a JPQL injection flaw that allows an authenticated user to craft malicious JPQL in the value parameter of the GET /api/utm-network-scans/searchPropertyValues endpoint. The application builds the query via String.format() and executes it with em.createQuery() without any parameter binding, enabling the attacker to read any entity data, including sensitive credential tables such as jhi_user.

The vulnerability affects the UTMStack platform supplied by UTMStack, specifically all releases prior to 11.2.16. Any installation using these versions is at risk until an upgrade to 11.2.16 or later is performed.

With a CVSS score of 7.1, the flaw provides high impact when the attacker can authenticate. The EPSS score is not available and the issue is not listed in CISA KEV, suggesting no confirmed exploitation yet. Attackers must log in and then exploit the endpoint to retrieve arbitrary database records, which could enable further compromise of the system.