High severity8.8NVD Advisory· Published Jun 3, 2025· Updated Jun 17, 2026
CVE-2025-48999
CVE-2025-48999
Description
DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, getUrlType() retrieves hostName. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at the replace location to construct a malicious JDBC statement. Version 2.10.10 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
2- github.com/dataease/dataease/commit/03b18db8a0fb7e9dc2c44f6d26d8c6221b7748c4nvdPatch
- github.com/dataease/dataease/security/advisories/GHSA-6pq2-6q8x-mp2rnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.