CVE-2025-5680 | Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0 Groovy Script SysScriptController.java executeScript script deserialization (ICAPT5)

A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected by this vulnerability is the function executeScript of the file /src/main/java/com/dstz/sys/rest/controller/SysScriptController.java of the component Groovy Script Handler. The manipulation of the argument script leads to deserialization.

This vulnerability is known as CVE-2025-5680. The attack can be launched remotely. Furthermore, there is an exploit available.