CVE-2025-64164

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15.

• CWE-502

• https://github.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320dbd3e32a7bbfe6Patch
• https://github.com/dataease/dataease/releases/tag/v2.10.15Release Notes
• https://github.com/dataease/dataease/security/advisories/GHSA-q754-4pc2-wjqwExploit, Patch, Third Party Advisory

Published

Nov 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64159Rejected reason: Not used
• CVE-2025-6416A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-64160Rejected reason: Not used
• CVE-2025-64161Rejected reason: Not used
• CVE-2025-64162Rejected reason: Not used
• CVE-2025-64163DataEase is an open source data visualization analysis tool.…9.8
• CVE-2025-64166Mercurius is a GraphQL adapter for Fastify. Prior to version…5.4
• CVE-2025-64167Combodo iTop is a web based IT service management tool. Vers…6.1
• CVE-2025-64168Agno is a multi-agent framework, runtime and control plane. …7.1
• CVE-2025-64169Wazuh is a free and open source platform used for threat pre…4.9
• CVE-2025-6417A vulnerability has been found in PHPGurukul Art Gallery Man…8.8
• CVE-2025-64170sudo-rs is a memory safe implementation of sudo and su writt…3.8