CVE-2025-0756

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Overview

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not restrict JNDI identifiers during the creation of platform data sources.

Impact

An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-99

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-07574.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is us CVE-2025-07586.1Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by CVE-2025-07593.3IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization CVE-2025-07602.7A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encrypt CVE-2025-07628.8Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2025-07634.3The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o CVE-2025-07646.5The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th CVE-2025-07654.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that CVE-2025-07679.8WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writer CVE-2025-07696.3PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an un CVE-2025-07819.9An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the CVE-2025-07836.3A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the