CVE-2025-0165

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
IBM	watsonx Orchestrate Cartridge for IBM Cloud Pak for Data	>= 4.8.4, <= 4.8.5; >= 5.0.0, <= 5.2.0

References

https://www.ibm.com/support/pages/node/7243596Vendor Advisory

Timeline

Published: Aug 30, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-01662.7IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code i CVE-2025-01673.4When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to CVE-2025-01687.5A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse CVE-2025-01695.4The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, CVE-2025-01706.1The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to CVE-2025-01717.5A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /CVE-2025-01727.5A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown fun CVE-2025-01737.5A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical. Affected by this issue is some unknown funct CVE-2025-01746.5A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affe CVE-2025-01756.1A vulnerability was found in code-projects Online Shop 1.0. It has been declared as problematic. This vulnerability affects unknown code of CVE-2025-01767.5A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue aff CVE-2025-01779.8The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080. This is due to the