Eng Knowage
22 CVEs affecting Eng Knowage. Latest disclosed: 2026-01-07. Critical: 4, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38702 | Critical | 9.9 | 2023-08-04 | Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-se… |
CVE-2025-59954 | Critical | 9.8 | 2025-09-30 | Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe o… |
CVE-2019-13188 | Critical | 9.8 | 2019-09-05 | In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. |
CVE-2024-57971 | Critical | 9.1 | 2025-02-16 | DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning… |
CVE-2021-30055 | High | 8.8 | 2021-04-05 | A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when run… |
CVE-2019-13348 | High | 8.8 | 2019-08-28 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes… |
CVE-2023-37472 | High | 7.7 | 2023-07-14 | Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attac… |
CVE-2023-35154 | High | 7.2 | 2023-06-23 | Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activat… |
CVE-2025-58441 | Medium | 6.5 | 2026-01-07 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The v… |
CVE-2023-36819 | Medium | 6.5 | 2023-07-03 | Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-serv… |
CVE-2022-39295 | Medium | 6.1 | 2022-10-13 | Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and… |
CVE-2021-30213 | Medium | 6.1 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP'… |
CVE-2021-30058 | Medium | 6.1 | 2021-04-05 | Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/… |
CVE-2019-13189 | Medium | 6.1 | 2019-08-28 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. |
CVE-2018-12355 | Medium | 6.1 | 2018-06-13 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. |
CVE-2021-30214 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. |
CVE-2021-30212 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/s… |
CVE-2021-30211 | Medium | 5.4 | 2021-05-12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update'… |
CVE-2021-30056 | Medium | 5.4 | 2021-04-05 | Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via th… |
CVE-2019-13190 | Medium | 5.3 | 2019-09-05 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. |