High severity · published Oct 17, 2025
CVE-2025-62419
DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE values are directly concatenated into the JDBC URL without filtering illegal parameters. This allows an attacker to inject a malicious JDBC string into the HOSTNAME field to bypass previously patched vulnerabilities CVE-2025-57773 and CVE-2025-58045. The vulnerability is fixed in version 2.10.14. No known workarounds exist.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
dataease · dataease
< 2.10.14 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62419
Patch
https://github.com/dataease/dataease/commit/bb320e42bf2cf862b9c4b438c1517547b53ed67b
Vendor Advisory
https://github.com/dataease/dataease/security/advisories/GHSA-x4x9-mjcf-99r9
More from dataease
9.8
CVE-2026-33122
DataEase has SQL Injection via Datasource Management
9.8
CVE-2026-33082
DataEase: SQL Injection in v2 Dataset Export
9.8
CVE-2026-23958
DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
9.8
CVE-2025-64428
DataEase DB2 JNDI Vulnerability
9.8
CVE-2025-64164
DataEase is vulnerable to Oracle JNDI Injection