CVE-2025-62422

HIGH EPSS 36.8%
Published Oct 17, 20258mo ago · Modified Jun 17, 20261w ago
8.7 CVSS 4.0
High
Find Similar
Published Oct 17, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago

Description

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in version 2.10.14. No known workarounds exist.

CVSS Details

Base Score
8.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
36.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
dataeasedataease* <2.10.14

References 2

  • github.com https://github.com/dataease/dataease/commit/3c52cc26c4cca1000294346cf99a84b25d38bfb2
    Patch
  • github.com https://github.com/dataease/dataease/security/advisories/GHSA-54m5-xrw4-mv36
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/dataease/dataease/commit/3c52cc26c4cca1000294346cf99a84b25d38bfb2
    Patch