CVE-2025-62419

DataEase (DataEase platform) prior to v2.10.14 contains a JDBC URL injection in the DB2 data source handler: when extraParams is empty, HOSTNAME, PORT, and DATABASE are concatenated into the JDBC URL without filtering, allowing an attacker to inject a malicious JDBC string via HOSTNAME to bypass ...

CVE-2025-62419: Deserialization of Untrusted Data

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE...

Arbitrary Code Execution

swiftmailer/swiftmailer is vulnerable to arbitrary code execution. The malicious code can be passed through the extraParams variable used to send extra parameters if the From, ReturnPath or Sender header came from a non-trusted source...