CVE-2025-20059

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-23

Affected software

Vendor	Product	Versions
Ping Identity	PingAM Java Policy Agent	<= 5.10.3; <= 2023.11.1; <= 2024.9

References

https://backstage.forgerock.com/knowledge/advisories/article/a61848355

Timeline

Published: Feb 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-20068.8The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in CVE-2025-200607.5An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android devic CVE-2025-200619.8mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploit CVE-2025-200626.1Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potent CVE-2025-200635.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion.CVE-2025-200648.7Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege. Syste CVE-2025-200656.7Uncontrolled search path for some Display Virtualization for Windows OS software before version 1797 within Ring 2: Device Drivers may allow CVE-2025-200676.0Observable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable informat CVE-2025-200687.1Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference platforms may allow an escalation of privilege. Sys CVE-2025-20078.1The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path CVE-2025-200706.7Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 CVE-2025-200716.5NULL pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via loca