Jalios JPlatform 10 SP6 < 10.0.6 Record Chooser SQL Injection
Priority MEDIUM 44CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an SQL command allows for unauthenticated users to trigger SQL Injection. This issue affects JPlatform before 10.0.6 and a PatchPlugin release 10.0.6 was issued 2023-02-06.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0042 36th percentileScored 2026-11-07
Fix Fixed JPlatform (Jalios): 10.0.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA JPlatform (Jalios) Fixed in 10.0.6
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0942
- 2026-10-03 Alias added: GHSA-vv22-vwq7-hqwj
References
More Jalios vulnerabilities
- TI-2019-13720 Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server… CVSS 3.1CRITICAL 9.8
- TI-2025-18707 Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS) CVSS 3.1HIGH 7.3
- TI-2025-18708 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE) CVSS 3.1MEDIUM 6.8
- TI-2020-12201 jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-0942 · CVE Program
- CVE-2025-0942 · NVD
- FIRST EPSS
- GHSA-vv22-vwq7-hqwj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences