CVE-2025-46579CWE-94

ZTE GoldenDB Database product has a DDE injection vulnerability

High · published April 27, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download and open the affected file, the DDE commands can be executed.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-04-27T01:34Z
EPSS history
Timeline
  • 27 APR 01:34Z
    ZTE GoldenDB Database product has a DDE injection vulnerability
    cvelistv5