CVE-2025-58748

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation (H2.java) does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon Redshift driver and leverages the socketFactory and socketFactoryArg parameters to invoke org.springframework.context.support.FileSystemXmlApplicationContext or ClassPathXmlApplicationContext with an attacker‑controlled remote XML resource, resulting in remote code execution. Versions up to and including 2.10.12 are affected. The issue is fixed in version 2.10.13. Updating to version 2.10.13 or later is the recommended remediation. No known workarounds exist.

• CWE-502

• https://github.com/dataease/dataease/commit/23a45e72a7abc37d5680b0a7cf691b8df378d4efPatch
• https://github.com/dataease/dataease/security/advisories/GHSA-23qw-9qrh-9rr8Exploit, Vendor Advisory

Published

Sep 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58742Insufficiently Protected Credentials, Improper Restriction o…5.9
• CVE-2025-58743Use of a Broken or Risky Cryptographic Algorithm (DES) vulne…7.5
• CVE-2025-58744Use of Default Credentials, Hard-coded Credentials vulnerabi…7.5
• CVE-2025-58745WeGIA is a Web manager for charitable institutions. The fix …8.8
• CVE-2025-58746The Volkov Labs Business Links panel for Grafana provides an…9
• CVE-2025-58747Dify is an LLM application development platform. In Dify ver…6.1
• CVE-2025-58749WebAssembly Micro Runtime (WAMR) is a lightweight standalone…5.3
• CVE-2025-5875A vulnerability classified as critical has been found in TP-…8.8
• CVE-2025-58750rAthena is an open-source cross-platform massively multiplay…9.1
• CVE-2025-58751Vite is a frontend tooling framework for JavaScript. Prior t…5.3
• CVE-2025-58752Vite is a frontend tooling framework for JavaScript. Prior t…5.3
• CVE-2025-58753Copyparty is a portable file server. In versions prior to 1.…7.5