CVE-2025-13268 Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
Remote attackers can inject malicious code via JDBC URL manipulation in Dromara dataCompare, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13268?
CVE-2025-13268 is a medium-severity code injection vulnerability in Dromara dataCompare, published on 17 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can be launched remotely. The exploit has been published and may be used.
Which versions are affected by CVE-2025-13268?
How do I fix CVE-2025-13268?
No fix has been published for CVE-2025-13268 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-13268 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-13268 exists.
Sources
Also known as GHSA-h92m-6623-764w.