SQL Injection Vulnerability in ESAPI esapi-java-legacy Affected by Improper Neutralization

CVE-2025-5878

What is CVE-2025-5878?

A security vulnerability exists in ESAPI esapi-java-legacy affecting the Encoder.encodeForSQL function, due to inadequate neutralization of special characters. This flaw could be exploited remotely, potentially leading to unauthorized database access. The development team demonstrated a proactive approach by addressing this issue promptly. Users are strongly encouraged to upgrade to version 2.7.0.0, which disables the vulnerable feature by default and issues warnings upon usage attempts. Additionally, documentation improvements have been made to better inform users of the associated risks.

References