CVE-2025-3164

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-3164

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3164.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-3164

Published

2025-04-03T15:31:06.610Z

Modified

2026-07-15T01:49:11.186587443Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Tencent Music Entertainment SuperSonic H2 Database Connection testConnect code injection

Details

A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/semantic/database/testConnect of the component H2 Database Connection Handler. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.9.3"
                },
                {
                    "last_affected": "0.9.3"
                },
                {
                    "introduced": "0.9.5"
                },
                {
                    "last_affected": "0.9.5"
                },
                {
                    "introduced": "0.9.7"
                },
                {
                    "last_affected": "0.9.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3164.json"
}

References

Affected packages

Git / github.com/tencentmusic/supersonic

Affected ranges

Type

GIT

Repo

https://github.com/tencentmusic/supersonic

Events

Introduced

6b60bfe6bcd4b5d0ae6fe23a9176977846a47830

Last affected

34cfa749c1817e6bd73f5f70496357839d70695f

Database specific

{
    "cpe": "cpe:2.3:a:tencentmusic:supersonic:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "last_affected": "0.9.0"
        },
        {
            "introduced": "0.9.1"
        },
        {
            "last_affected": "0.9.1"
        },
        {
            "introduced": "0.9.2"
        },
        {
            "last_affected": "0.9.2"
        },
        {
            "introduced": "0.9.4"
        },
        {
            "last_affected": "0.9.4"
        },
        {
            "introduced": "0.9.6"
        },
        {
            "last_affected": "0.9.6"
        },
        {
            "introduced": "0.9.8"
        },
        {
            "last_affected": "0.9.8"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

0.*

0.9.0

0.9.1

0.9.2

0.9.4

0.9.6

0.9.8

v0.*

v0.9.0

v0.9.2

v0.9.4

v0.9.6

v0.9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3164.json"