CVE-2025-15088

MediumCVSS 6.3

Published: 25/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

A vulnerability was detected in JEPaaS up to 7.2.8 in the postilService.loadPostils function of /je/postil/postil/loadPostil. Manipulation of the keyWord argument results in SQL injection, and remote exploitation is possible. The exploit is now public and may be used.

Risk Assessment

An attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion, and in some cases server compromise.

Recommendation

Immediately update JEPaaS to a patched version or implement parameterized SQL queries for the loadPostils function. Until then, restrict access to the affected endpoint.

Other vulnerabilities in JEPaaS

CVE-2025-14694Medium
A vulnerability was found in ketr JEPaaS up to 7.2.8. It impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Manipulation of the argument keyWord results in SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early but did not respond.

Original NVD description (English source)

A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil/loadPostil. Performing a manipulation of the argument keyWord results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS