CVE-2025-57772

CVE-2025-57772 describes a critical Remote Code Execution (RCE) bypass vulnerability in DataEase, an open-source business intelligence and data visualization tool, affecting versions prior to 2.10.12. The flaw allows an attacker to bypass H2 database filtering logic by manipulating the JDBC URL, enabling the specification of the H2 driver and subsequent RCE. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a network-based attack vector, low attack complexity, and requires no user interaction, leading to high impacts on confidentiality, integrity, and availability. The FAUCET Risk Score is 87/100, indicating significant risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, which is typical for the majority of CVEs.