Dataease EUVD-2025-19589

| CVE-2025-53004 CRITICAL

Improper Neutralization of Substitution Characters (CWE-153)

2025-06-30 security-advisories@github.com

Authentication Bypass Dataease

9.8

CVSS 3.1 · GitHub Advisory

Share

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

5

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 01:25 euvd

EUVD-2025-19589

Analysis Generated

Mar 16, 2026 - 01:25 vuln.today

PoC Detected

Jul 10, 2025 - 13:42 vuln.today

Public exploit code

CVE Published

Jun 30, 2025 - 21:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg parameters could trigger a bypass vulnerability. This issue has been patched in version 2.10.11.

AnalysisAI

A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.

Technical ContextAI

Vulnerability type: remote code execution. CVSS 9.8 indicates critical severity with likely remote exploitation vector. Affects DataEase.

RemediationAI

Monitor vendor channels for patch availability.

More in Dataease

View all

CVE-2025-49003 CRITICAL Act Now POC

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor m

CVE-2025-49002 CRITICAL Act Now POC

Auth bypass in DataEase via CVE-2025-49001 patch evasion. PoC available.

CVE-2025-49001 CRITICAL Act Now POC

Auth bypass in DataEase BI tool before 2.10.10.

CVE-2025-53005 CRITICAL Act Now POC

A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.

CVE-2025-53006 CRITICAL Act Now POC

A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.

CVE-2026-23958 CRITICAL Act Now POC

DataEase data visualization tool prior to 2.10.19 uses MD5-hashed passwords without salting, allowing attackers to crack

CVE-2024-46997 CRITICAL Act Now POC

DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r

CVE-2023-37258 CRITICAL Act Now POC

DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r

CVE-2023-33963 CRITICAL Act Now POC

DataEase is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-28437 CRITICAL Act Now POC

Dataease is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2022-39312 CRITICAL Act Now POC

Dataease is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r

CVE-2022-34115 CRITICAL Act Now POC

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. Rated cr

Same weakness CWE-153 – Improper Neutralization of Substitution Characters

View all

CVE-2025-49003 CRITICAL POC

CVE-2025-53005 CRITICAL POC

CVE-2025-53006 CRITICAL POC

CVE-2026-9694 MEDIUM POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2012-1723 CRITICAL POC

CVE-2017-10271 HIGH POC

CVE-2015-1427 CRITICAL POC

CVE-2025-3248 CRITICAL POC

Share

EUVD-2025-19589 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy