/Vulnerability Library

DataEase 2.10.4-2.10.7 - Remote Code Execution

CVE-2025-32966
Verified

Description

DataEase prior to version 2.10.8 contains a remote code execution caused by insecure backend JDBC link handling, letting authenticated users execute arbitrary code, exploit requires user authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Affected Product

dataease

Published Date

May 2, 2026

Template Author

chrisjr404

CVE-2025-32966.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-32966
CWE ID:
cwe-94

References

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7https://github.com/dataease/dataease/security/advisories/GHSA-xx2m-gmwg-mf3rhttps://github.com/vulhub/vulhub/tree/master/dataease/CVE-2025-32966

Remediation Steps

Update to version 2.10.8 or later.