Vulnerability · Published Nov 17, 2025 · Assigned by VulDB
CVE-2025-13268Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
Medium 6.3
In plain English
A medium-severity injection in dataCompare from Dromara. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 77.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can be launched remotely. The exploit has been published and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dromara | dataCompare | 1.0.01.0.1 |
Weakness: CWE-74, CWE-707 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-332603 | Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection vdb-entry, technical-description
- VDB-332603 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #689460 | dromara dataCompare 1.0.1 Improper Input Validation third-party-advisory
- https://github.com/dromara/dataCompare/issues/13 exploit, issue-tracking