CVE-2025-5679

MEDIUM

Tongzhouyun Agilebpm < 2.5.0 - Insecure Deserialization

Title source: rule

Description

A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStrByFreeMarker of the file /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. The manipulation of the argument str leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Exploits (1)

References (4)

Scores

CVSS v3 6.3
EPSS 0.0043
EPSS Percentile 62.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE
CWE-502 CWE-20
Status published

Affected Products (1)

tongzhouyun/agilebpm < 2.5.0

Timeline

Published Jun 05, 2025
Tracked Since Feb 18, 2026