CVE-2025-49002

CRITICAL 9.8CVE-2025-49002 · Published 03/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
dataease dataease	`< 2.10.10`	`2.10.10`

Description

DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

References

dataease/dataease security advisory · Exploit
dataease/dataease security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free