CVE-2025-57773

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerability has been fixed in version 2.10.12.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-502

Affected software

VendorProductVersions
dataeasedataease< 2.10.12

References

Timeline

Published
Aug 25, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-577747.8There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with DigilenCVE-2025-577757.8There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vulCVE-2025-577767.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with DCVE-2025-577777.8There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab. CVE-2025-577787.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB fileCVE-2025-57789.8A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. Affected is an unknown funcCVE-2025-577808.8A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. CVE-2025-577818.4The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic LiCVE-2025-577835.3Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticatedCVE-2025-577843.3Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker toCVE-2025-577856.5A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupCVE-2025-577865.4A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specia
CVE-2025-57773: Critical severity, CVSS 9.8 | Vulnix