CVE-2025-24974
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
- Affected products
- Dataease
- Dataease
- < 2.10.6
- Fix
- Available
- CVSS 4.0
- 8.6 HIGH
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.4% (29th percentile)
- Weakness
- CWE-862, CWE-89
- NVD status
- Analyzed
- Published
- 2025-03-13
CVE-2025-24974 at NVD
No indexed exploits for CVE-2025-24974 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-24974 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.