/Vulnerability Library

DataEase - Remote Code Execution

CVE-2025-49002
Verified

Description

DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection template intended only to identify exposed DataEase instances and extract possible version hints for manual verification. It does not attempt authentication bypass, JDBC exploitation, or command execution.

Severity

High

Exploit Probability

50%

Affected Product

dataease

Published Date

April 20, 2026

Template Author

weqi

CVE-2025-49002.yaml
7.5Severity

CVSS Metrics

CVE ID:
cve-2025-49002
CWE ID:
cwe-290

References

https://github.com/dataease/dataease/security/advisories/GHSA-999m-jv2p-5h34https://nvd.nist.gov/vuln/detail/CVE-2025-49002

Remediation Steps

Upgrade DataEase to 2.10.10 or later, restrict public access to management/API endpoints, and review whether vulnerable datasource-related interfaces are exposed.