Vulnerability · Published Jun 3, 2025 · Assigned by GitHub_M

CVE-2025-49002Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability

High 8.2

In plain English

A high-severity authentication bypass by spoofing in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 50.4% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)50.4%top 1.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.10

Weakness: CWE-290 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References

https://github.com/dataease/dataease/security/advisories/GHSA-999m-jv2p-5h34 x_refsource_CONFIRM
https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7 x_refsource_MISC