vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-5878

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

HIGH
7.3
CVSS Score
Published: June 29, 2025 at 11:11 AM UTC
Updated: June 17, 2026 at 09:48 AM UTC
1 product affected across 1 vendorESAPI (Java legacy)

Using esapi-java-legacy by ESAPI?

Get instant alerts when new vulnerabilities affect esapi-java-legacy - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.3
Exploit prediction
EPSS 0.5%
SSVC
PoC

Description

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

References (10)

Related
Source: [email protected]
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf
Patch
Source: [email protected]
https://github.com/ESAPI/esapi-java-legacy/commit/e2322914304d9b1c52523ff24be495b7832f6a56
Patch
Source: [email protected]
https://github.com/ESAPI/esapi-java-legacy/commit/f75ac2c2647a81d2cfbdc9c899f8719c240ed512
Patch
Source: [email protected]
https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.7.0.0
Related
Source: [email protected]
https://github.com/uglory-gll/javasec/blob/main/ESAPI.md
SignaturePermissions Required
Source: [email protected]
https://vuldb.com/?ctiid.314321
VDB EntryTechnical Description
Source: [email protected]
https://vuldb.com/?id.314321
Third Party Advisory
Source: [email protected]
https://vuldb.com/?submit.590149

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.3HIGHVulDB
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-20CWE-138

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card