Dataease vulnerabilities

Products

• Dataease 103
• Sqlbot 15

Newest

• dataease sqlbot SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attacke… CVE-2026-121453 5.1 MediumNovember 3, 2026
• dataease DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting CVE-2026-102755 5.1 MediumOctober 14, 2026
• dataease DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting CVE-2026-102756 5.1 MediumOctober 14, 2026
• dataease DataEase: Stored SQL Injection via dateFormat field templates CVE-2026-104143 8.7 HighOctober 14, 2026
• dataease DataEase: Stored SQL Injection in group-field binning bounds CVE-2026-104142 8.7 HighOctober 14, 2026
• dataease DataEase: SQL Injection in datasource metadata identifiers CVE-2026-104141 8.7 HighOctober 14, 2026
• dataease DataEase Utils.java Utils.buildCalcField sql injection CVE-2026-108824 5.3 MediumOctober 12, 2026
• dataease sqlbot SQLBot through 1.10.1 Improper Access Control via Dashboard Update CVE-2026-93660 7.1 HighSeptember 18, 2026
• dataease sqlbot SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution CVE-2026-53557 7.7 HighSeptember 17, 2026
• dataease sqlbot Stored XSS via SVG Upload CVE-2026-53555 5.1 MediumSeptember 17, 2026
• dataease sqlbot SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read CVE-2026-53556 6.0 MediumSeptember 17, 2026
• dataease sqlbot SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing CVE-2026-53554 7.3 HighSeptember 17, 2026
• dataease A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component. CVE-2023-40772 4.3 MediumSeptember 14, 2026
• dataease DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting CVE-2026-90529 5.1 MediumSeptember 13, 2026
• dataease DataEase before 2.10.26 Access Control Bypass via Share Tickets CVE-2026-82879 5.3 MediumAugust 31, 2026
• dataease DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints CVE-2026-82878 5.3 MediumAugust 31, 2026
• dataease DataEase has a Path Traversal Vulnerability CVE-2026-45532 8.7 HighAugust 18, 2026
• dataease sqlbot SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html CVE-2026-72743 5.1 MediumAugust 10, 2026
• dataease DataEase: Authenticated Stored XSS in DataEase Template Static Resources CVE-2026-49867 6.3 MediumJuly 15, 2026
• dataease DataEase: Unauthorized Command Execution Vulnerability CVE-2026-46684 9.5 CriticalJuly 15, 2026
• dataease DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection CVE-2026-45320 8.7 HighJuly 15, 2026
• dataease DataEase: Stored SQL Injection Vulnerability CVE-2026-45535 8.7 HighJuly 15, 2026
• dataease DataEase: Path Traversal Vulnerability CVE-2026-45533 8.3 HighJuly 15, 2026
• dataease DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper CVE-2026-50124 7.1 HighJuly 15, 2026
• dataease DataEase: Arbitrary SQL execution in preview path (direct data disclosure) CVE-2026-50030 7.1 HighJuly 15, 2026
• dataease DataEase: Arbitrary File Write Vulnerability CVE-2026-45419 8.5 HighJuly 15, 2026
• dataease DataEase: SQL injection vulnerability CVE-2026-45417 8.7 HighJuly 15, 2026
• dataease DataEase: RCE Vulnerability CVE-2026-45534 9.0 CriticalJuly 15, 2026
• dataease DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets CVE-2026-50530 7.1 HighJuly 7, 2026
• dataease DataEase: Link Token Leakage Prior to Share Password/Ticket Validation CVE-2026-50529 8.7 HighJuly 7, 2026
• dataease DataEase: authenticated stored XSS in the dashboard text components CVE-2026-55647 5.1 MediumJuly 7, 2026
• dataease DataEase: Authenticated SQL Injection in Chart Quota Filters CVE-2026-55635 8.7 HighJuly 7, 2026
• dataease DataEase: Hardcoded JWT Signing Secret in ShareLink CVE-2026-57172 8.3 HighJuly 7, 2026
• dataease DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE) CVE-2026-53751 8.7 HighJuly 7, 2026
• dataease DataEase: Unauthorized Access to Engine Database via previewSql Endpoint CVE-2026-53730 8.7 HighJuly 7, 2026
• dataease DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass CVE-2026-55633 8.7 HighJuly 7, 2026
• dataease DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management CVE-2026-55631 7.2 HighJuly 7, 2026
• dataease DataEase ExportCenter IDOR allows cross-user export task access CVE-2026-53729 8.7 HighJuly 7, 2026
• dataease Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection CVE-2026-8724 5.1 MediumMay 17, 2026
• dataease sqlbot SQLBot: Unauthorized Access Vulnerability CVE-2026-42463 8.6 HighMay 13, 2026
• dataease sqlbot SQLBot prompt injection allows arbitrary SQL execution and remote code execution CVE-2026-33324 9.4 CriticalMay 5, 2026
• dataease DataEase: Quartz Deserialization → Remote Code Execution CVE-2026-40901 Public exploit 7.5 HighApril 16, 2026
• dataease DataEase has SQL Injection via Stacked Queries CVE-2026-40900 8.7 HighApril 16, 2026
• dataease DataEase has an Arbitrary File Read Vulnerability CVE-2026-40899 8.3 HighApril 16, 2026
• dataease DataEase SQL Injection Vulnerability CVE-2026-33207 8.6 HighApril 16, 2026
• dataease DataEase has SQL Injection via Datasource Management CVE-2026-33122 8.6 HighApril 16, 2026
• dataease DataEase has SQL Injection via Datasource Save Flow CVE-2026-33121 8.7 HighApril 16, 2026
• dataease DataEase has SQL Injection through its getFieldEnumObj Endpoint CVE-2026-33084 8.7 HighApril 16, 2026
• dataease DataEase has SQL Injection in Order By Clause CVE-2026-33083 8.7 HighApril 16, 2026
• dataease DataEase: SQL Injection in v2 Dataset Export CVE-2026-33082 8.7 HighApril 16, 2026
• Show olderLoading…