What is CVE-2025-24974?

CVE-2025-24974 is a medium-severity vulnerability in Dataease, classified under SQL Injection. CVSS score: 6.5/10. Published 2025-03-13.

How severe is CVE-2025-24974?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Dataease

CVE-2025-24974

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in…

Vulnerability class: SQL Injection

EPSS: 0.004 (28.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Dataease — versions < 2.10.6

Weakness classification (CWE)

CWE-89 — SQL Injection
CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2025-24974?: CVE-2025-24974 is a medium-severity vulnerability in Dataease, classified under SQL Injection. CVSS score: 6.5/10. Published 2025-03-13.
How severe is CVE-2025-24974?: Medium severity. CVSS v3 base score is 6.5 out of 10.