PT-2025-27359

🗓️ 29 Jun 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 7 Views

Vulnerability in ESAPI prior to version 2.7.0.0 allows remote SQL Injection attacks. Upgrade recommended.

Reporter	Title	Published	Views	Family All 91
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Neutralization (CVE-2025-5878)	21 Nov 202511:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.5.0 fixes multiple security vulnerabilities	20 Jun 202308:52	–	ibm
IBM Security Bulletins	Security Bulletin: Weaker than expected SQL injection protection may affect IBM Business Automation Workflow traditional - CVE-2025-5878	30 Jan 202617:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages fixes multiple vulnerabilities	9 Jul 202506:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Commons Text 1.9	8 Dec 202204:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 23 (4.2.0.23)	2 Sep 202512:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm
GithubExploit	Exploit for Path Traversal in Owasp Enterprise_Security_Api	17 Feb 202616:23	–	githubexploit
GithubExploit	Exploit for CVE-2025-5878	8 Jun 202605:26	–	githubexploit
BDU FSTEC	The vulnerability of the `Validator.getValidDirectoryPath(String, String, File, boolean)` function in the web application security management library ESAPI (OWASP Enterprise Security API) allows a attacker to execute arbitrary code.	13 Jul 202200:00	–	bdu_fstec

Source	Link
vuldb	www.vuldb.com/
t	www.t.me/cvenotify/127021
github	www.github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf
github	www.github.com/ESAPI/esapi-java-legacy/commit/f75ac2c2647a81d2cfbdc9c899f8719c240ed512
github	www.github.com/ESAPI/esapi-java-legacy/commit/e2322914304d9b1c52523ff24be495b7832f6a56
vuldb	www.vuldb.com/
github	www.github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.7.0.0
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-5878
twitter	www.twitter.com/cracbot/status/1941089659410661507
ubuntu	www.ubuntu.com/security/CVE-2025-5878

16 Apr 2026 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 27.5

CVSS 3.17.5 - 9.8

CVSS 46.9

CVSS 37.3

EPSS0.02674

SSVC