The vulnerability occurs in Spring Data JPA's Query-by-Example (QBE) implementation where user-controlled example values are incorporated into SQL LIKE clauses without proper escaping when using STARTING, ENDING, or CONTAINING matchers. The primary vulnerable function is QueryByExamplePredicateBuilder.getPredicate() which processes example values and applies StringMatcher transformations. This function would appear in stack traces when building queries from malicious examples. The ExampleMatcher configuration methods (like GenericPropertyMatcher.ignoreCase()) are secondary indicators as they establish the unsafe matching mode. The patch likely modified these areas to add escaping logic for example values before wildcard expansion.