Every CVE Search/ Get API key

CVE-2025-30706

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...

7.5 HighFix available

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.63%Up 0.6 points since Apr 16, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
CVE-2025-30706
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
EUVDEUVD-2025-11044 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
EUVD-2025-11044
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mxpq-3mg3-vqx7 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). ...

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
GHSA-mxpq-3mg3-vqx7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
NVD 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
CVE-2025-30706
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
OSVUBUNTU-CVE-2025-30706 7.5

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Record
UBUNTU-CVE-2025-30706
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15026-1 No score

mysql-connector-java-9.3.0-1.1 on GA media

These are all security issues fixed in the mysql-connector-java-9.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15026-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20089-1 No score

Security update for mysql-connector-java

This update for mysql-connector-java fixes the following issues:

  • Upgrade to Version 9.3.0
    • CVE-2025-30706: Fixed Connector/J vulnerability (bsc#1241693)
    • Updatable ResultSet fails with 'Parameter index out of range'.
    • Fixed Resultset UPDATE methods not checking validity of ResultSet.
    • DatabaseMetaData clean up.
    • Fixed implement missing methods in DatabaseMetaDataUsingInfoSchema.
    • Fixed procedure execution failing when the parameter name contains escape character.
    • Fixed allow only Krb5LoginModule in Kerberos authentication.
    • Fixed EXECUTE on CallableStatement resulting in ArrayIndexOutOfBoundsException.
    • Mysql connector use an uneffective way to match numericValue.
    • Fixed parameter index validation not proper in CallableStatement
Record
openSUSE-SU-2025:20089-1
Updated
2026-11-02
OSVSUSE-SU-2025:21144-1 No score

Security update for mysql-connector-java

This update for mysql-connector-java fixes the following issues:

  • Upgrade to Version 9.3.0
    • CVE-2025-30706: Fixed Connector/J vulnerability (bsc#1241693)
    • Updatable ResultSet fails with 'Parameter index out of range'.
    • Fixed Resultset UPDATE methods not checking validity of ResultSet.
    • DatabaseMetaData clean up.
    • Fixed implement missing methods in DatabaseMetaDataUsingInfoSchema.
    • Fixed procedure execution failing when the parameter name contains escape character.
    • Fixed allow only Krb5LoginModule in Kerberos authentication.
    • Fixed EXECUTE on CallableStatement resulting in ArrayIndexOutOfBoundsException.
    • Mysql connector use an uneffective way to match numericValue.
    • Fixed parameter index validation not proper in CallableStatement
Record
SUSE-SU-2025:21144-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mysql-connector-java
SUSE:Linux Enterprise Server 16.0
 before 9.3.0-160000.1.1
9.3.0-160000.1.1
mysql-connector-java
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 9.3.0-160000.1.1
9.3.0-160000.1.1
mysql-connector-java
Ubuntu:14.04:LTS
 All versions, plus listed versions
5.1.25-15.1.26-15.1.27-15.1.28-1
 None known
mysql-connector-java
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.1.32-15.1.38-1
 None known
mysql-connector-java
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.1.42-15.1.44-15.1.45-1
 None known
mysql-connector-java
openSUSE:Tumbleweed
 before 9.3.0-1.1
9.3.0-1.1
mysql-connector-java
openSUSE:Leap 16.0
 before 9.3.0-160000.1.1
9.3.0-160000.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30706 is a high vulnerability (CVSS 7.5) in Oracle Corporation Mysql Connectors, published April 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in mysql-connector-java 9.3.0-160000.1.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open