Dataease vulnerabilities
108 CVEs and advisories name Dataease as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-57172DataEase: Hardcoded JWT Signing Secret in ShareLink
- CVE-2026-53751DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
- CVE-2026-53730DataEase: Unauthorized Access to Engine Database via previewSql Endpoint
- CVE-2026-55633DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass
- CVE-2026-55631DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
- CVE-2026-53729DataEase ExportCenter IDOR allows cross-user export task access
- CVE-2026-42463SQLBot: Unauthorized Access Vulnerability
- CVE-2026-33324SQLBot prompt injection allows arbitrary SQL execution and remote code execution
- CVE-2026-40901DataEase: Quartz Deserialization → Remote Code Execution
- CVE-2026-40900DataEase has SQL Injection via Stacked Queries
- CVE-2026-40899DataEase has an Arbitrary File Read Vulnerability
- CVE-2026-33207DataEase SQL Injection Vulnerability
- CVE-2026-33122DataEase has SQL Injection via Datasource Management
- CVE-2026-33121DataEase has SQL Injection via Datasource Save Flow
- CVE-2026-33084DataEase has SQL Injection through its getFieldEnumObj Endpoint
- CVE-2026-33083DataEase has SQL Injection in Order By Clause
- CVE-2026-33082DataEase: SQL Injection in v2 Dataset Export
- CVE-2026-5417Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
- CVE-2026-32950SQLBot: RCE via SQL Injection in Excel Upload Endpoint
- CVE-2026-32949SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL
- CVE-2026-32939DataEase is Vulnerable to H2 JDBC RCE Bypass
- CVE-2026-32622SQLBot: Remote Code Execution via Terminology Poisoning
- CVE-2026-32140Dataease: Redshift JDBC RCE Bypass
- CVE-2026-32139Dataease: Unfiltered active SVG content leads to Stored XSS
- CVE-2026-32137DataEase SQL Injection Vulnerability
- CVE-2025-15598Dataease SQLBot JWT Token auth.py validateEmbedded signature verification
- CVE-2025-15597Dataease SQLBot API Endpoint assistant.py access control
- CVE-2026-23958DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
- CVE-2025-69285SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability
- CVE-2025-64428DataEase DB2 JNDI Vulnerability