CVE-2025-14694
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was found in ketr JEPaaS up to 7.2.8. It impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Manipulation of the argument keyWord results in SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early but did not respond.
Risk Assessment
Attackers can remotely execute SQL queries, potentially leading to data leakage, database modification, or full system compromise.
Recommendation
Apply vendor patches if available, or restrict access to the vulnerable endpoint. Implement input filtering and use parameterized queries.
Other vulnerabilities in JEPaaS
Original NVD description (English source)
A vulnerability was found in ketr JEPaaS up to 7.2.8. This impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Performing a manipulation of the argument keyWord results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS