# cve.now: Dataease

The newest entries naming Dataease as an affected vendor (up to 200), of 108 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121453](https://cve.now/CVE-2026-121453.md): SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint (CVSS 5.1)
- [CVE-2026-102755](https://cve.now/CVE-2026-102755.md): DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting (CVSS 5.1)
- [CVE-2026-102756](https://cve.now/CVE-2026-102756.md): DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting (CVSS 5.1)
- [CVE-2026-104143](https://cve.now/CVE-2026-104143.md): DataEase: Stored SQL Injection via dateFormat field templates (CVSS 8.7)
- [CVE-2026-104142](https://cve.now/CVE-2026-104142.md): DataEase: Stored SQL Injection in group-field binning bounds (CVSS 8.7)
- [CVE-2026-104141](https://cve.now/CVE-2026-104141.md): DataEase: SQL Injection in datasource metadata identifiers (CVSS 8.7)
- [CVE-2026-93660](https://cve.now/CVE-2026-93660.md): SQLBot through 1.10.1 Improper Access Control via Dashboard Update (CVSS 7.1)
- [CVE-2026-53557](https://cve.now/CVE-2026-53557.md): SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution (CVSS 7.7)
- [CVE-2026-53555](https://cve.now/CVE-2026-53555.md): Stored XSS via SVG Upload (CVSS 5.1)
- [CVE-2026-53556](https://cve.now/CVE-2026-53556.md): SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read (CVSS 6.0)
- [CVE-2026-53554](https://cve.now/CVE-2026-53554.md): SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing (CVSS 7.3)
- [CVE-2023-40772](https://cve.now/CVE-2023-40772.md): A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted requ (CVSS 4.3)
- [CVE-2026-82879](https://cve.now/CVE-2026-82879.md): DataEase before 2.10.26 Access Control Bypass via Share Tickets (CVSS 5.3)
- [CVE-2026-82878](https://cve.now/CVE-2026-82878.md): DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints (CVSS 5.3)
- [CVE-2026-45532](https://cve.now/CVE-2026-45532.md): DataEase has a Path Traversal Vulnerability (CVSS 8.7)
- [CVE-2026-72743](https://cve.now/CVE-2026-72743.md): SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html (CVSS 5.1)
- [CVE-2026-49867](https://cve.now/CVE-2026-49867.md): DataEase: Authenticated Stored XSS in DataEase Template Static Resources (CVSS 6.3)
- [CVE-2026-46684](https://cve.now/CVE-2026-46684.md): DataEase: Unauthorized Command Execution Vulnerability (CVSS 9.5)
- [CVE-2026-45320](https://cve.now/CVE-2026-45320.md): DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection (CVSS 8.7)
- [CVE-2026-45535](https://cve.now/CVE-2026-45535.md): DataEase: Stored SQL Injection Vulnerability (CVSS 8.7)
- [CVE-2026-45533](https://cve.now/CVE-2026-45533.md): DataEase: Path Traversal Vulnerability (CVSS 8.3)
- [CVE-2026-50124](https://cve.now/CVE-2026-50124.md): DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper (CVSS 7.1)
- [CVE-2026-50030](https://cve.now/CVE-2026-50030.md): DataEase: Arbitrary SQL execution in preview path (direct data disclosure) (CVSS 7.1)
- [CVE-2026-45419](https://cve.now/CVE-2026-45419.md): DataEase: Arbitrary File Write Vulnerability (CVSS 8.5)
- [CVE-2026-45417](https://cve.now/CVE-2026-45417.md): DataEase: SQL injection vulnerability (CVSS 8.7)
- [CVE-2026-45534](https://cve.now/CVE-2026-45534.md): DataEase: RCE Vulnerability (CVSS 9.0)
- [CVE-2026-50530](https://cve.now/CVE-2026-50530.md): DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets (CVSS 7.1)
- [CVE-2026-50529](https://cve.now/CVE-2026-50529.md): DataEase: Link Token Leakage Prior to Share Password/Ticket Validation (CVSS 8.7)
- [CVE-2026-55647](https://cve.now/CVE-2026-55647.md): DataEase: authenticated stored XSS in the dashboard text components (CVSS 5.1)
- [CVE-2026-55635](https://cve.now/CVE-2026-55635.md): DataEase: Authenticated SQL Injection in Chart Quota Filters (CVSS 8.7)
- [CVE-2026-57172](https://cve.now/CVE-2026-57172.md): DataEase: Hardcoded JWT Signing Secret in ShareLink (CVSS 8.3)
- [CVE-2026-53751](https://cve.now/CVE-2026-53751.md): DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE) (CVSS 8.7)
- [CVE-2026-53730](https://cve.now/CVE-2026-53730.md): DataEase: Unauthorized Access to Engine Database via previewSql Endpoint (CVSS 8.7)
- [CVE-2026-55633](https://cve.now/CVE-2026-55633.md): DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass (CVSS 8.7)
- [CVE-2026-55631](https://cve.now/CVE-2026-55631.md): DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management (CVSS 7.2)
- [CVE-2026-53729](https://cve.now/CVE-2026-53729.md): DataEase ExportCenter IDOR allows cross-user export task access (CVSS 8.7)
- [CVE-2026-42463](https://cve.now/CVE-2026-42463.md): SQLBot: Unauthorized Access Vulnerability (CVSS 8.6)
- [CVE-2026-33324](https://cve.now/CVE-2026-33324.md): SQLBot prompt injection allows arbitrary SQL execution and remote code execution (CVSS 9.4)
- [CVE-2026-40901](https://cve.now/CVE-2026-40901.md): DataEase: Quartz Deserialization → Remote Code Execution (CVSS 7.5)
- [CVE-2026-40900](https://cve.now/CVE-2026-40900.md): DataEase has SQL Injection via Stacked Queries (CVSS 8.7)
- [CVE-2026-40899](https://cve.now/CVE-2026-40899.md): DataEase has an Arbitrary File Read Vulnerability (CVSS 8.3)
- [CVE-2026-33207](https://cve.now/CVE-2026-33207.md): DataEase SQL Injection Vulnerability (CVSS 8.6)
- [CVE-2026-33122](https://cve.now/CVE-2026-33122.md): DataEase has SQL Injection via Datasource Management (CVSS 8.6)
- [CVE-2026-33121](https://cve.now/CVE-2026-33121.md): DataEase has SQL Injection via Datasource Save Flow (CVSS 8.7)
- [CVE-2026-33084](https://cve.now/CVE-2026-33084.md): DataEase has SQL Injection through its getFieldEnumObj Endpoint (CVSS 8.7)
- [CVE-2026-33083](https://cve.now/CVE-2026-33083.md): DataEase has SQL Injection in Order By Clause (CVSS 8.7)
- [CVE-2026-33082](https://cve.now/CVE-2026-33082.md): DataEase: SQL Injection in v2 Dataset Export (CVSS 8.7)
- [CVE-2026-5417](https://cve.now/CVE-2026-5417.md): Dataease SQLbot Elasticsearch es\_engine.py get\_es\_data\_by\_http server-side request forgery (CVSS 5.1)
- [CVE-2026-32950](https://cve.now/CVE-2026-32950.md): SQLBot: RCE via SQL Injection in Excel Upload Endpoint (CVSS 8.6)
- [CVE-2026-32949](https://cve.now/CVE-2026-32949.md): SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL (CVSS 8.7)
- [CVE-2026-32939](https://cve.now/CVE-2026-32939.md): DataEase is Vulnerable to H2 JDBC RCE Bypass (CVSS 7.7)
- [CVE-2026-32622](https://cve.now/CVE-2026-32622.md): SQLBot: Remote Code Execution via Terminology Poisoning (CVSS 8.6)
- [CVE-2026-32140](https://cve.now/CVE-2026-32140.md): Dataease: Redshift JDBC RCE Bypass (CVSS 9.3)
- [CVE-2026-32139](https://cve.now/CVE-2026-32139.md): Dataease: Unfiltered active SVG content leads to Stored XSS (CVSS 5.3)
- [CVE-2026-32137](https://cve.now/CVE-2026-32137.md): DataEase SQL Injection Vulnerability (CVSS 9.3)
- [CVE-2025-15598](https://cve.now/CVE-2025-15598.md): Dataease SQLBot JWT Token auth.py validateEmbedded signature verification (CVSS 6.3)
- [CVE-2025-15597](https://cve.now/CVE-2025-15597.md): Dataease SQLBot API Endpoint assistant.py access control (CVSS 5.3)
- [CVE-2026-23958](https://cve.now/CVE-2026-23958.md): DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover (CVSS 8.8)
- [CVE-2025-69285](https://cve.now/CVE-2025-69285.md): SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability (CVSS 7.7)
- [CVE-2025-64428](https://cve.now/CVE-2025-64428.md): DataEase DB2 JNDI Vulnerability (CVSS 8.9)
- [CVE-2025-64164](https://cve.now/CVE-2025-64164.md): DataEase is vulnerable to Oracle JNDI Injection (CVSS 8.9)
- [CVE-2025-64163](https://cve.now/CVE-2025-64163.md): DataEase's DB2 is vulnerable to SSRF (CVSS 8.9)
- [CVE-2025-62419](https://cve.now/CVE-2025-62419.md): DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration (CVSS 8.2)
- [CVE-2025-62420](https://cve.now/CVE-2025-62420.md): DataEase vulnerable to remote code execution via H2 JDBC driver bypass (CVSS 8.2)
- [CVE-2025-62421](https://cve.now/CVE-2025-62421.md): DataEase vulnerable to stored cross-site scripting via file upload bypass (CVSS 5.5)
- [CVE-2025-62422](https://cve.now/CVE-2025-62422.md): DataEase SQL injection vulnerability (CVSS 8.7)
- [CVE-2025-58748](https://cve.now/CVE-2025-58748.md): Dataease H2 data source JDBC URL validation bypass leads to remote code execution (CVSS 8.7)
- [CVE-2025-58046](https://cve.now/CVE-2025-58046.md): Dataease has a JDBC attack vulnerability in the Impala datasource (CVSS 8.7)
- [CVE-2025-58045](https://cve.now/CVE-2025-58045.md): Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter (CVSS 7.1)
- [CVE-2025-57772](https://cve.now/CVE-2025-57772.md): Dataease H2 JDBC RCE Bypass (CVSS 8.2)
- [CVE-2025-57773](https://cve.now/CVE-2025-57773.md): Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability (CVSS 8.2)
- [CVE-2025-53006](https://cve.now/CVE-2025-53006.md): Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability (CVSS 8.9)
- [CVE-2025-53005](https://cve.now/CVE-2025-53005.md): Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability (CVSS 8.9)
- [CVE-2025-53004](https://cve.now/CVE-2025-53004.md): Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability (CVSS 8.9)
- [CVE-2025-49003](https://cve.now/CVE-2025-49003.md): Dataease H2 JDBC Connection Remote Code Execution (CVSS 8.9)
- [CVE-2025-49002](https://cve.now/CVE-2025-49002.md): Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability (CVSS 8.2)
- [CVE-2025-49001](https://cve.now/CVE-2025-49001.md): Dataease Authentication Bypass Vulnerability (CVSS 7.7)
- [CVE-2025-48999](https://cve.now/CVE-2025-48999.md): Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability (CVSS 6.8)
- [CVE-2025-48998](https://cve.now/CVE-2025-48998.md): Dataease MYSQL JDBC File Reading Vulnerability (CVSS 7.3)
- [CVE-2025-46566](https://cve.now/CVE-2025-46566.md): Dataease redshift JDBC Connection Remote Code Execution (CVSS 6.8)
- [CVE-2025-32966](https://cve.now/CVE-2025-32966.md): Dataease H2 JDBC Connection Remote Code Execution (CVSS 8.2)
- [CVE-2025-27138](https://cve.now/CVE-2025-27138.md): DataEase has an improper authentication vulnerability (CVSS 7.7)
- [CVE-2025-27103](https://cve.now/CVE-2025-27103.md): Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability​ (CVSS 7.3)
- [CVE-2025-24974](https://cve.now/CVE-2025-24974.md): DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability (CVSS 7.3)
- [CVE-2024-56511](https://cve.now/CVE-2024-56511.md): DataEase has an unauthorized vulnerability (CVSS 9.3)
- [CVE-2024-55952](https://cve.now/CVE-2024-55952.md): Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability (CVSS 8.6)
- [CVE-2024-55953](https://cve.now/CVE-2024-55953.md): Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability (CVSS 8.6)
- [CVE-2024-52295](https://cve.now/CVE-2024-52295.md): DataEase has a forged JWT token vulnerability (CVSS 9.3)
- [CVE-2024-47073](https://cve.now/CVE-2024-47073.md): Dataease arbitrary interface access vulnerability (CVSS 9.3)
- [CVE-2024-47074](https://cve.now/CVE-2024-47074.md): Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability (CVSS 9.3)
- [CVE-2024-46997](https://cve.now/CVE-2024-46997.md): DataEase's H2 datasource has a remote command execution risk (CVSS 9.8)
- [CVE-2024-46985](https://cve.now/CVE-2024-46985.md): DataEase has an XXE vulnerability (CVSS 7.5)
- [CVE-2024-31441](https://cve.now/CVE-2024-31441.md): Arbitrary File Reading in DataEase (CVSS 7.5)
- [CVE-2024-30269](https://cve.now/CVE-2024-30269.md): DataEase has database configuration information exposure vulnerability (CVSS 5.3)
- [CVE-2024-23328](https://cve.now/CVE-2024-23328.md): The Dataease datasource exists deserialization and arbitrary file read vulnerability (CVSS 9.1)
- [CVE-2023-40183](https://cve.now/CVE-2023-40183.md): DataEase has a vulnerability to obtain user cookies (CVSS 7.5)
- [CVE-2023-37258](https://cve.now/CVE-2023-37258.md): DataEase has a SQL injection vulnerability that can bypass blacklists (CVSS 8.8)
- [CVE-2023-37257](https://cve.now/CVE-2023-37257.md): The DataEase panel and dataset have a stored XSS vulnerability (CVSS 5.4)
- [CVE-2023-35164](https://cve.now/CVE-2023-35164.md): Unauthorized users can manipulate a dashboard created by an administrator in DataEase (CVSS 6.3)
- [CVE-2023-34463](https://cve.now/CVE-2023-34463.md): Unauthorized users can delete applications in DataEase (CVSS 8.1)
- [CVE-2023-35168](https://cve.now/CVE-2023-35168.md): DataEase has a privilege bypass vulnerability (CVSS 6.5)
- [CVE-2023-33963](https://cve.now/CVE-2023-33963.md): DataEase data source has deserialization vulnerability (CVSS 9.8)
- [CVE-2023-32310](https://cve.now/CVE-2023-32310.md): DataEase API interface has IDOR vulnerability (CVSS 8.1)
- [CVE-2023-28637](https://cve.now/CVE-2023-28637.md): DataEase AWS redshift data source exists for remote code execution vulnerability (CVSS 8.0)
- [CVE-2023-28437](https://cve.now/CVE-2023-28437.md): SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed (CVSS 9.8)
- [CVE-2023-28435](https://cve.now/CVE-2023-28435.md): Dataease file upload interface does not verify permission or file type (CVSS 6.5)
- [CVE-2023-25807](https://cve.now/CVE-2023-25807.md): DataEase dashboard has a stored XSS vulnerability (CVSS 7.2)
- [CVE-2022-39312](https://cve.now/CVE-2022-39312.md): Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/dataease
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.