OpenBravo Hibernate suffers from a remote HQL injection vulnerability. Vendor has patched this in versions 3.0PR15Q3.4 and 3.0PR15Q4.1.