CVE-2025-63690

critical · 9.1

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability.

9.1

CVSS

1.0%

EPSS (exploit prob.)

61st

EPSS percentile

2025-11-07

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-470

Affected products

Vendor	Product	Affected versions
pig4cloud	pig	<= 3.8.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/LockeTom/vulnerability/blob/main/md/pig_Remote_Code_Execution_Vulnerability.md
https://github.com/pig-mesh/pig/issues/1199

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-63690