CVE-2025-2927
Last modified
CVE-2025-2927 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been classified as critical. Affected is an unknown function of the file /parameter/getFileTypeList.jsp. The manipulation of the argument typename leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Esafenet | Cdg | 5.6.3.154.205 |
References
- https://github.com/Rain1er/report/blob/main/CDG/Mg%3D%3D.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.301902Permissions Required, VDB Entry
- https://vuldb.com/?id.301902Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.521263Third Party Advisory, VDB Entry
- https://github.com/Rain1er/report/blob/main/CDG/Mg%3D%3D.mdExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-2927?
How severe is CVE-2025-2927?
How do I fix CVE-2025-2927?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-2925A vulnerability has been found in HDF5 up to 1.14.6 and clas…5.5
- CVE-2025-2926A vulnerability was found in HDF5 up to 1.14.6 and classifie…5.5
- CVE-2025-29266Unraid 7.0.0 before 7.0.1 allows remote users to access the …9.6
- CVE-2025-29267SQL Injection vulnerability in Abis, Inc Adjutant Core Accou…6.5
- CVE-2025-29268ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded …9.8
- CVE-2025-29269ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS co…9.8
- CVE-2025-29270Incorrect access control in the realtime.cgi endpoint of Dee…10
- CVE-2025-2928SQL Injection affecting the Archiver role.7.2
- CVE-2025-29280Stored cross-site scripting vulnerability exists in PerfreeB…4.8
- CVE-2025-29281In PerfreeBlog version 4.0.11, regular users can exploit the…8.8
- CVE-2025-29287An arbitrary file upload vulnerability in the ueditor compon…9.8
- CVE-2025-2929The Order Delivery Date WordPress plugin before 12.4.0 does …7.1
Are you affected by CVE-2025-2927?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST