01 Record
CVE-2025-10702
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows
HighPUBLISHEDCNA: ProgressSoftware
CNA base score8.6 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
02 Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.32% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 24.7% of scored records. A rank, not a probability.
- NVD base score
- 8.6 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Deferred. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2025-11-19 15:46Z11 MO AGO
- Last updated
- 2026-02-26 16:21Z8 MO AGO
- Reserved
- 2025-09-18
- Assigning CNA
- ProgressSoftware
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.6)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
- Weaknesses
- CWE-94Improper Control of Generation of Code ('Code Injection')Base
- Data version
- 5.2
- Document digest
- d099fdb89ae30edd1818f221cbd29075b8793c6c6e4ecc5cd29044b90743a331
05 Affected products
VendorProductVersionsPlatforms