Every CVE Search/ Get API key

CVE-2025-5878

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

6.9 MediumPublic exploitFix available

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.49%Up 0.4 points since Jun 29, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.9

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
CVE-2025-5878
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 2.0
7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-138, CWE-20
Updated
2026-11-02
EUVDEUVD-2025-28693 6.9

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
EUVD-2025-28693
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-hxjw-v2v5-hpcr 5.5

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue...

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
GHSA-hxjw-v2v5-hpcr
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
NVD 5.5

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
CVE-2025-5878
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20, CWE-138
Updated
2026-11-02
OSV 5.5

ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
CVE-2025-5878
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-138, CWE-20
Updated
2026-11-02
OSVDEBIAN-CVE-2025-5878 5.5

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
DEBIAN-CVE-2025-5878
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHLW-2026-cc6f4a613453615e 5.5

Lightwell Security Advisory: esapi 2.3.0.0-rhlw-00005

Red Hat Lightwell has released org.owasp.esapi:esapi 2.3.0.0-rhlw-00005 with a backported security fix.

CVE-2025-5878: ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element

This patched artifact is a drop-in replacement for org.owasp.esapi:esapi 2.3.0.0 from Maven Central.

Record
RHLW-2026-cc6f4a613453615e
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
OSVUBUNTU-CVE-2025-5878 5.5

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Record
UBUNTU-CVE-2025-5878
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libowasp-esapi-java
Debian:12
 All versions, plus listed versions
2.4.0.0-22.4.0.0-2.1
 None known
libowasp-esapi-java
Debian:13
 All versions, plus listed versions
2.4.0.0-2.1
 None known
libowasp-esapi-java
Debian:11
From an advisory covering 3 CVEs
 before 2.4.0.0-0+deb11u1, plus listed versions
2.1.0-3.12.2.3.1-12.2.3.1-1~bpo11+1
2.4.0.0-0+deb11u1
org.owasp.esapi:esapi
Red Hat Lightwell:Maven
 before 2.3.0.0-rhlw-00005, plus listed versions
2.0.12.0GA2.0_rc102.0_rc112.0_rc9
Show 12 moreShow less
2.1.02.1.0.12.2.0.02.2.0.0-RC22.2.0.0-RC32.2.1.02.2.1.0-RC12.2.1.12.2.2.02.2.3.02.2.3.12.3.0.0
2.3.0.0-rhlw-00005
libowasp-esapi-java
Ubuntu:Pro:16.04:LTS
 before 2.1.0-2ubuntu0.1~esm1, plus listed versions
2.1.0-2
2.1.0-2ubuntu0.1~esm1
libowasp-esapi-java
Ubuntu:Pro:18.04:LTS
 before 2.1.0-3ubuntu0.18.04.1~esm1, plus listed versions
2.1.0-3
2.1.0-3ubuntu0.18.04.1~esm1
libowasp-esapi-java
Ubuntu:Pro:20.04:LTS
 before 2.1.0-3ubuntu0.20.04.1~esm1, plus listed versions
2.1.0-3
2.1.0-3ubuntu0.20.04.1~esm1
libowasp-esapi-java
Ubuntu:Pro:22.04:LTS
 before 2.2.3.1-1ubuntu0.1~esm1, plus listed versions
2.1.0-3.12.2.3.1-1
2.2.3.1-1ubuntu0.1~esm1
libowasp-esapi-java
Ubuntu:24.04:LTS
 before 2.4.0.0-2ubuntu0.1, plus listed versions
2.4.0.0-2
2.4.0.0-2ubuntu0.1
libowasp-esapi-java
Ubuntu:25.10
 All versions, plus listed versions
2.4.0.0-22.4.0.0-2.1
 None known
libowasp-esapi-java
Ubuntu:26.10
 All versions, plus listed versions
2.4.0.0-2.1
 None known
libowasp-esapi-java
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.4.0.0-2.1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubfantasy-fql/ESAPI-SQLinjection-CVE-2025-5878-Exploit2026-06-08

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-5878 is a medium vulnerability (CVSS 6.9) in Esapi Esapi-java-legacy, published June 29, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in org.owasp.esapi:esapi 2.3.0.0-rhlw-00005.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open