PT-2025-38668

Name of the Vulnerable Software and Affected Versions jeecgboot JimuReport versions up to 2.1.2 Description A vulnerability exists in jeecgboot JimuReport up to version 2.1.2. The issue impacts an unknown function within the /drag/onlDragDataSource/testConnection file of the MySQL JDBC Handler...

CVE-2025-58045

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not...

CVE-2025-58046

Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct...

CVE-2025-58748

CVE-2025-58748 affects DataEase up to version 2.10.12, where the H2 data source (H2.java) does not validate that a JDBC URL starts with jdbc:h2 . This enables a crafted configuration to substitute the Amazon Redshift driver and leverage socketFactory/socketFactoryArg to trigger a remote XML resou...

CVE-2025-58045

DataEase (DataEase Open Source) contains a JDBC URL injection vulnerability affecting DB2 and MongoDB data source configuration handlers. In versions up to 2.10.13, when extraParams is empty, the HOSTNAME, PORT, and DATABASE values are concatenated into the JDBC URL without filtering illegal para...

CVE-2025-58045 Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not...

CVE-2025-58045 Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not...

PT-2025-37721

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 2.10.13 Description: Dataease is an open source data analytics and visualization platform. The H2 data source implementation H2.java lacks validation to ensure that a provided JDBC URL begins with jdbc:h2. This allo...

PT-2025-37720

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 2.10.13 Dataease versions 2.10.12 and earlier Description: Dataease is a data visualization and analysis platform. Versions up to and including 2.10.12 are susceptible to remote code execution through the Impala dat...

BIT-NIFI-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

CVE-2025-57141

rsbi-os 4.7 is vulnerable to Remote Code Execution RCE in sqlite-jdbc...

CVE-2025-57141

rsbi-os 4.7 is vulnerable to Remote Code Execution RCE in sqlite-jdbc...

CVE-2025-57141

rsbi-os 4.7 is vulnerable to Remote Code Execution RCE in sqlite-jdbc...

CVE-2025-57141

rsbi-os 4.7 is vulnerable to Remote Code Execution RCE in sqlite-jdbc...

rsbi-os 安全漏洞

rsbi-os is a Business Intelligence software system from Rays BI Personal Developer. A security vulnerability exists in rsbi-os version 4.7, which stems from a remote code execution in sqlite-jdbc...

PT-2025-36471

Name of the Vulnerable Software and Affected Versions: rsbi-os version 4.7 Description: rsbi-os version 4.7 is vulnerable to Remote Code Execution RCE in sqlite-jdbc. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2025-57141

CVE-2025-57141 affects rsbi-os 4.7 with a vulnerability in sqlite-jdbc that allows Remote Code Execution (RCE). The CVSS 3.1 base score is 9.8 (CRITICAL) with network access, no user interaction, and no privileges required. The available connected documents do not provide concrete exploit details...

CVE-2025-6507

A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vulnerability arises from the ability to...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now included (CVE-2025-49146)

Summary The following vulnerabilities that can affect IBM Storage Scale and the Management GUI and could provide weaker than expected security are now fixed CVE-2025-49146. Vulnerability Details CVEID:CVE-2025-49146 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and unt...

CVE-2025-5662 Deserialization Vulnerability in h2oai/h2o-3

A deserialization vulnerability exists in the H2O-3 REST API POST /99/ImportSQLTable that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution RCE due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present i...