CVE-2025-8107

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafted commands.

This vulnerability only affects OceanBase tenants in Oracle mode. Tenants in MySQL mode are unaffected.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-269 CWE-668

Affected software

Vendor	Product	Versions
OB	OceanBase Server	>= 3.2.4.x, < 3.2.4.8; >= 4.2.1 x, < 4.2.1.10; >= 4.2.x, < 4.2.5; >= 4.3.3.x, < 4.3.3.2

References

https://github.com/oceanbase/oceanbase/security

Timeline

Published: Jul 24, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-81086.7An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This v CVE-2025-81098.8Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.CVE-2025-81108.8Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.CVE-2025-81136.1The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribu CVE-2025-81144.7A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) proces CVE-2025-81155.4A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability CVE-2025-81166.1PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will resul CVE-2025-81177.5PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset pas CVE-2025-81186.5PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attem CVE-2025-81194.3PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which w CVE-2025-81209.8Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to uploa CVE-2025-81218.8Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks.