CVE-2025-46566

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.9.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-923

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-465677.8LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the `llamafy_baichuan CVE-2025-465687.5Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirli CVE-2025-465697.4Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP CVE-2025-46576.7A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Len CVE-2025-465702.6vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the Pag CVE-2025-465715.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged us CVE-2025-465729.3passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to CVE-2025-465738.6passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to CVE-2025-465745.3There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system CVE-2025-465757.5There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system CVE-2025-465766.5There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to byp CVE-2025-465777.5There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information.