CVE-2026-72743 | Medium | 5.4 | 2026-08-10 | SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE out… |
CVE-2026-50124 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload… |
CVE-2026-50030 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck throu… |
CVE-2026-49867 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateMa… |
CVE-2026-46684 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-… |
CVE-2026-45535 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultVal… |
CVE-2026-45534 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc… |
CVE-2026-45533 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as… |
CVE-2026-45419 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServe… |
CVE-2026-45417 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSc… |
CVE-2026-45320 | | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by Sqlparse… |
CVE-2026-57172 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowin… |
CVE-2026-55647 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html wi… |
CVE-2026-55635 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values direc… |
CVE-2026-55633 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated… |
CVE-2026-55631 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary… |
CVE-2026-53751 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unico… |
CVE-2026-53730 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit pe… |
CVE-2026-53729 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/… |
CVE-2026-50530 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the re… |
CVE-2026-50529 | | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-… |
CVE-2026-8724 | Medium | 4.7 | 2026-05-17 | A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component D… |
CVE-2026-42463 | High | 8.1 | 2026-05-13 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Obj… |
CVE-2026-33324 | High | 8.8 | 2026-05-05 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to… |
CVE-2026-40901 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-colle… |
CVE-2026-40900 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetDa… |
CVE-2026-40899 | Medium | 6.5 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the… |
CVE-2026-33207 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTa… |
CVE-2026-33122 | Critical | 9.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource up… |
CVE-2026-33121 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource sa… |
CVE-2026-33084 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of… |
CVE-2026-33083 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection pa… |
CVE-2026-33082 | Critical | 9.8 | 2026-04-16 | DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerability in the dataset export functionali… |
CVE-2026-5417 | Medium | 4.7 | 2026-04-02 | A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32939 | High | 8.1 | 2026-03-20 | DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below have inconsistent Locale handling between the JDBC URL validation logic… |
CVE-2026-32622 | High | 8.8 | 2026-03-19 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability th… |
CVE-2026-32140 | High | 8.8 | 2026-03-12 | Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an attacker can force the JDBC driver to l… |
CVE-2026-32139 | Medium | 5.4 | 2026-03-12 | Dataease is an open source data visualization analysis tool. In DataEase 2.10.19 and earlier, the static resource upload interface allows SVG uploads. However… |
CVE-2026-32137 | High | 8.8 | 2026-03-12 | Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2026-23958 | Critical | 9.8 | 2026-01-22 | Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing sec… |
CVE-2025-69285 | Medium | 6.1 | 2026-01-21 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in t… |
CVE-2025-64428 | Critical | 9.8 | 2025-11-20 | Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for… |
CVE-2025-64164 | Critical | 9.8 | 2025-11-06 | Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections… |
CVE-2025-64163 | Critical | 9.8 | 2025-11-06 | DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. Howeve… |
CVE-2025-62422 | High | 8.8 | 2025-10-17 | DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerab… |
CVE-2025-62421 | Medium | 5.4 | 2025-10-17 | DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improp… |
CVE-2025-62420 | High | 8.8 | 2025-10-17 | DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vulnerability exists in the H2 database con… |
CVE-2025-62419 | High | 7.5 | 2025-10-17 | DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB… |
CVE-2025-58748 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation (H2.java) does not v… |
CVE-2025-58046 | Critical | 9.8 | 2025-09-15 | Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote co… |
CVE-2025-58045 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserializa… |
CVE-2025-57773 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injecti… |
CVE-2025-57772 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC… |
CVE-2025-53006 | Critical | 9.8 | 2025-07-02 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters… |
CVE-2025-53005 | Critical | 9.8 | 2025-07-01 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's PostgreSQ… |
CVE-2025-53004 | Critical | 9.8 | 2025-06-30 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift… |
CVE-2025-49003 | Critical | 9.8 | 2025-06-26 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java… |
CVE-2025-49002 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 tha… |
CVE-2025-49001 | Critical | 9.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully… |
CVE-2025-48999 | High | 8.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a mali… |
CVE-2025-48998 | High | 8.8 | 2025-06-03 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenti… |
CVE-2025-46566 | Critical | 9.8 | 2025-05-01 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This is… |
CVE-2025-32966 | Critical | 9.8 | 2025-04-23 | DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This is… |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-27103 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authent… |
CVE-2025-24974 | Medium | 6.5 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary f… |
CVE-2024-57707 | Critical | 9.8 | 2025-02-07 | An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. |
CVE-2024-56511 | Critical | 9.8 | 2025-01-10 | DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter… |
CVE-2024-55953 | High | 8.1 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When c… |
CVE-2024-55952 | High | 8.8 | 2024-12-18 | DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jd… |
CVE-2024-52295 | Critical | 9.8 | 2024-11-13 | DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is… |
CVE-2024-47073 | Critical | 9.1 | 2024-11-07 | DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions… |
CVE-2024-47074 | Critical | 9.8 | 2024-10-11 | DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connect… |
CVE-2024-46997 | Critical | 9.8 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully co… |
CVE-2024-46985 | High | 7.5 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static res… |
CVE-2024-31441 | High | 7.5 | 2024-05-14 | DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is… |
CVE-2024-30269 | Medium | 5.3 | 2024-04-08 | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting… |
CVE-2024-23328 | Critical | 9.1 | 2024-02-29 | Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execu… |
CVE-2023-40183 | High | 7.5 | 2023-09-21 | DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain us… |
CVE-2023-40771 | High | 7.5 | 2023-09-01 | SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist functio… |
CVE-2023-37258 | High | 8.8 | 2023-07-25 | DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. Th… |
CVE-2023-37257 | Medium | 5.4 | 2023-07-25 | DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnera… |
CVE-2023-35164 | Medium | 6.3 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization… |
CVE-2023-35168 | Medium | 6.5 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privileg… |
CVE-2023-34463 | High | 8.1 | 2023-06-26 | DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can… |
CVE-2023-33963 | Critical | 9.8 | 2023-06-01 | DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, wh… |
CVE-2023-32310 | High | 8.1 | 2023-06-01 | DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to in… |
CVE-2023-28637 | High | 8.0 | 2023-03-28 | DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properl… |
CVE-2023-28437 | Critical | 9.8 | 2023-03-25 | Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fix… |
CVE-2023-28435 | Medium | 6.5 | 2023-03-24 | Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in ca… |
CVE-2023-25807 | High | 7.2 | 2023-02-28 | DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store maliciou… |
CVE-2021-38239 | High | 7.5 | 2023-02-15 | SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. |
CVE-2022-39312 | Critical | 9.8 | 2022-10-25 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source i… |
CVE-2022-34115 | Critical | 9.8 | 2022-07-22 | DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. |
CVE-2022-34114 | High | 8.8 | 2022-07-22 | Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. |
CVE-2022-34113 | Critical | 9.8 | 2022-07-22 | An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. |