CVE-2025-15088
⚪ Do wiadomości
Wstrzyknięcie SQL w ketr JEPaaS umożliwia zdalne wykonanie ataku.
CVSS
6.3
EPSS
0.3%
Exploit
none
Vendor
Opis źródłowy (NVD)
A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil/loadPostil. Performing a manipulation of the argument keyWord results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
sql-injection
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 6.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.3% |
| Opublikowano (NVD) | 2025-12-25 22:15:42 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-07 13:10:00 UTC |
Referencje
- https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/jepaas-v7.2.8-sqlinject1.md ([email protected])
- https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/jepaas-v7.2.8-sqlinject1.md#2%E5%A4%8D%E7%8E%B0replicate ([email protected])
- https://vuldb.com/?ctiid.338416 ([email protected])
- https://vuldb.com/?id.338416 ([email protected])
- https://vuldb.com/?submit.708321 ([email protected])