CVE-2025-32966

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.

CVSS v4.0

8.2 HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

4.40% chance of exploitation in the next 30 days, 91th percentile

Nuclei

critical · CWE-94

Published

2025-04-23

Proof-of-concept exploits (1)

• dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-32966.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/dataease/CVE-2025-32966

References

• CVE Record
• NVD entry

Related

• CVE-2022-34113
• CVE-2023-28637
• CVE-2024-46997
• CVE-2024-52295
• CVE-2024-56511
• CVE-2025-49002