Sonatype Nexus Repository 3 has a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. This task is only available if the non-default setting nexus.reindex.search.by.pattern.visible is enabled. A user with the nexus:tasks:create privilege can supply a crafted filter condition that is executed as SQL, allowing modification of the Nexus database.