CVE-2025-58441 | Medium | 6.5 | 2026-01-07 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The v… |
CVE-2025-59954 | Critical | 9.8 | 2025-09-30 | Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe o… |
CVE-2025-55007 | Low | 3.5 | 2025-09-01 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnera… |
CVE-2024-57971 | Critical | 9.1 | 2025-02-16 | DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning… |
CVE-2024-54795 | Medium | 5.4 | 2025-01-21 | SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function. |
CVE-2024-54794 | Critical | 9.1 | 2025-01-21 | The script input feature of SpagoBI 3.5.1 allows arbitrary code execution. |
CVE-2024-54792 | Medium | 6.1 | 2025-01-21 | A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another use… |
CVE-2023-38702 | Critical | 9.9 | 2023-08-04 | Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-se… |
CVE-2023-37472 | High | 7.7 | 2023-07-14 | Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attac… |
CVE-2023-36819 | Medium | 6.5 | 2023-07-03 | Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-serv… |
CVE-2023-35154 | High | 7.2 | 2023-06-23 | Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activat… |
CVE-2022-39295 | Medium | 6.1 | 2022-10-13 | Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and… |
CVE-2021-30214 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. |
CVE-2021-30213 | Medium | 6.1 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP'… |
CVE-2021-30212 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/s… |
CVE-2021-30211 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update'… |
CVE-2021-30058 | Medium | 6.1 | 2021-04-05 | Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/… |
CVE-2021-30057 | Medium | 4.8 | 2021-04-05 | A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" v… |
CVE-2021-30056 | Medium | 5.4 | 2021-04-05 | Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via th… |
CVE-2021-30055 | High | 8.8 | 2021-04-05 | A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when run… |
CVE-2013-6231 | High | 8.8 | 2020-01-10 | SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script |
CVE-2013-6234 | High | 8.0 | 2019-11-22 | Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading… |
CVE-2019-13188 | Critical | 9.8 | 2019-09-05 | In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. |
CVE-2019-13190 | Medium | 5.3 | 2019-09-05 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. |
CVE-2019-13348 | High | 8.8 | 2019-08-28 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes… |
CVE-2019-13189 | Medium | 6.1 | 2019-08-28 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. |
CVE-2018-12355 | Medium | 6.1 | 2018-06-13 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. |
CVE-2014-7296 | | | 2014-10-08 | The default configuration in the accessibility engine in SpagoBI 5.0.0 does not set FEATURE_SECURE_PROCESSING, which allows remote authenticated users to execu… |
CVE-2013-6233 | | | 2014-03-09 | Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description fie… |
CVE-2013-6232 | | | 2014-03-09 | Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web script or HTML via a document note in… |