CVE-2025-32966

CRITICAL NUCLEI

DataEase < 2.10.8 - Authenticated Remote Code Execution via JDBC Link

Title source: llm

Exploitation Summary

CVE-2025-32966 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.

Nuclei Templates (1)

DataEase 2.10.4-2.10.7 - Remote Code Execution

CRITICALVERIFIEDby ChrisJr404

Shodan: http.html:"dataease"

FOFA: body="dataease"

References (1)

Core 1

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7

Scores

CVSS v3 9.8

EPSS 0.0393

EPSS Percentile 89.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-290

Status published

Products (1)

dataease/dataease < 2.10.8

Published Apr 23, 2025

Tracked Since Feb 18, 2026