Dataease vulnerabilities
108 CVEs and advisories name Dataease as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121453SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
- CVE-2026-102755DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting
- CVE-2026-102756DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
- CVE-2026-104143DataEase: Stored SQL Injection via dateFormat field templates
- CVE-2026-104142DataEase: Stored SQL Injection in group-field binning bounds
- CVE-2026-104141DataEase: SQL Injection in datasource metadata identifiers
- CVE-2026-93660SQLBot through 1.10.1 Improper Access Control via Dashboard Update
- CVE-2026-53557SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
- CVE-2026-53555Stored XSS via SVG Upload
- CVE-2026-53556SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read
- CVE-2026-53554SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing
- CVE-2023-40772A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted requ
- CVE-2026-82879DataEase before 2.10.26 Access Control Bypass via Share Tickets
- CVE-2026-82878DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
- CVE-2026-45532DataEase has a Path Traversal Vulnerability
- CVE-2026-72743SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
- CVE-2026-49867DataEase: Authenticated Stored XSS in DataEase Template Static Resources
- CVE-2026-46684DataEase: Unauthorized Command Execution Vulnerability
- CVE-2026-45320DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
- CVE-2026-45535DataEase: Stored SQL Injection Vulnerability
- CVE-2026-45533DataEase: Path Traversal Vulnerability
- CVE-2026-50124DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
- CVE-2026-50030DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
- CVE-2026-45419DataEase: Arbitrary File Write Vulnerability
- CVE-2026-45417DataEase: SQL injection vulnerability
- CVE-2026-45534DataEase: RCE Vulnerability
- CVE-2026-50530DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
- CVE-2026-50529DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
- CVE-2026-55647DataEase: authenticated stored XSS in the dashboard text components
- CVE-2026-55635DataEase: Authenticated SQL Injection in Chart Quota Filters