Dataease
Monthly
Path traversal on Windows-hosted DataEase instances allows unauthenticated remote attackers to read arbitrary files from the server filesystem by exploiting a filter bypass unique to the Windows backslash path separator. All DataEase versions prior to 2.10.23 on Windows are affected; the root cause is that string truncation logic blocks only the forward-slash but not the backslash, which Windows treats as an equivalent directory separator. No public exploit has been identified at time of analysis, but the vendor-confirmed CVSS 4.0 score of 8.7 with a network-accessible, no-privileges vector warrants immediate patching on any Windows deployment.
Authentication bypass via forged JWTs in DataEase, an open-source data visualization and BI tool, allows remote unauthenticated attackers to impersonate any user (including administrators) in enterprise deployments before version 2.10.23. The enterprise TokenFilter passes attacker-supplied X-DE-TOKEN values to a validator that checks only token presence and length, then decodes the JWT without verifying its signature, so tokens with a chosen uid and oid are accepted whenever the enterprise license is valid (licenseValid=true). CVSS 4.0 rates this 9.5 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated SQL injection in DataEase dashboard variables allows data compromise. DataEase versions prior to 2.10.23 fail to sanitize dashboard SQL variables for non-in and non-between operators,
Stored SQL injection in DataEase (open source data visualization/BI tool) versions prior to 2.10.23 allows an authenticated user who can define SQL-type datasets to persist malicious SQL through variable defaultValue entries, which later execute against the backend database whenever any user with dataset read permission opens the dataset. The flaw (CWE-89) enables reading and modifying arbitrary database data, and CVSS 4.0 rates it 8.7 (High). No public exploit has been identified at time of analysis, but the upstream fix commit is public, so exploitation prerequisites are well documented.
Arbitrary directory deletion in DataEase, an open-source data visualization and analysis platform, allows an authenticated user (PR:L) to abuse the export-center bulk delete API by injecting path traversal sequences (../) into task identifiers, which are passed unsanitized to ExportCenterManage.delete and used to recursively delete server directories. All releases prior to 2.10.23 are affected, and the fix in 2.10.23 constrains deletion to identifiers that exist as legitimate export tasks in the database. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but a full commit-level patch is publicly available which lowers the barrier to reverse-engineering an exploit.
Remote authenticated code execution in DataEase before 2.10.23 lets a low-privileged user abuse the Excel/datasource upload workflow to run arbitrary Java. By uploading a crafted payload.zip via /datasource/upload and defining an H2 datasource that references the archive through the zip: protocol, an attacker forces CalciteProvider.jdbcFetchResultField to execute a query that triggers precompiled Java aliases embedded in test.mv.db. The vendor CVSS 4.0 vector scores this 7.1 (confidentiality-only), but the underlying primitive is full arbitrary code execution; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary SQL read access in DataEase before 2.10.23 lets authenticated users abuse the SQL preview feature (/de2api/datasetData/previewSql) to run attacker-supplied queries against any configured datasource. Because DatasetDataManage.previewSql passes the decoded PreviewSqlDTO.sql straight into datasourceRequest.query and CalciteProvider.fetchResultField executes it via prepareStatement().executeQuery(), an attacker can read any table the datasource account can access and receive the rows in the preview response. No public exploit identified at time of analysis, but the fix commit and advisory are public, making the flaw easy to reverse-engineer.
Arbitrary file write in DataEase (open-source BI/data-visualization platform) before 2.10.23 lets an authenticated user (PR:L) abuse the /de2api/templateManage/save template-save endpoint to write attacker-controlled Base64 content to arbitrary filesystem paths. Because StaticResourceServer#saveFilesToServe extracted the filename using only a forward-slash split, crafted staticResource names containing traversal sequences or backslashes escaped the intended static-resource directory. No public exploit or CISA KEV listing is identified at time of analysis, though the fixing commit and advisory are public.
SQL injection in DataEase before 2.10.23 lets an authenticated low-privilege user compromise the backend datasource by abusing the datasource connection-status check, where io.dataease.datasource.provider.CalciteProvider#checkStatus concatenates the user-controlled configuration.getSchema() value into getTablesSql and runs it via executeQuery. Because the schema/owner string is embedded directly into metadata queries for DB2, SQL Server, PostgreSQL, Oracle and other datasources, an attacker who can create or edit a datasource can inject arbitrary SQL and read or alter data on the connected database. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor commit that replaces string concatenation with parameterized PreparedStatements.
Reflection-based remote code execution in DataEase before 2.10.23 lets an authenticated operator who can configure a Redshift datasource achieve arbitrary code execution on the server. The Redshift JDBC driver loads an attacker-controlled rsjdbc.ini from the system temp directory and honors a malicious socketFactory pointing at Spring's FileSystemXmlApplicationContext, turning a normal JDBC connection into a code-execution chain. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor has confirmed and patched the flaw in 2.10.23.
Insecure Direct Object Reference in DataEase before 2.10.24 lets a holder of any valid share-link token retrieve arbitrary datasets by tampering with the request body. The share-mode chart endpoint POST /de2api/chartData/getData validates only that sceneId matches the resourceId bound to the link token, but never checks that the supplied tableId and field IDs belong to the shared resource, so an attacker can swap in identifiers for datasets they were never granted. No public exploit is identified at time of analysis, but the flaw is trivially exploitable by anyone already given a legitimate share link.
Authentication bypass in DataEase open-source BI platform before 2.10.24 lets unauthenticated remote attackers who know a protected share UUID retrieve a valid X-DE-LINK-TOKEN from the /de2api/share/proxyInfo endpoint, because the token is issued before the share password or ticket is checked. With that token an attacker can call subsequent share APIs and read data behind password-protected dashboards without valid credentials. No public exploit identified at time of analysis; the flaw is fixed in 2.10.24.
SQL injection in DataEase before 2.10.24 lets an authenticated user inject arbitrary SQL into queries run against configured datasources by supplying malicious quota (chart aggregation) or Y-axis filter values. The flaw sits in Quota2SQLObj.getYWheres(), which embeds attacker-controlled filter values directly into generated SQL while skipping the literal validation and escaping that other filter paths enforce. No public exploit identified at time of analysis, but the fixing commit and GitHub Security Advisory publicly disclose the exact vulnerable code path.
Authentication bypass in DataEase before 2.10.24 lets remote attackers forge valid share-link JWTs because ShareSecretManage ships with a hardcoded signature key (link-pwd-fit2cloud). An attacker who has obtained any passwordless share can mint linkToken JWTs that pass TokenFilter verification and access backend resources as the original share creator, even after that share has been revoked. There is no public exploit identified at time of analysis, but the hardcoded key is disclosed in the advisory, making forgery trivial once the signing algorithm is known.
Arbitrary code execution in DataEase before 2.10.24 lets authenticated users bypass H2 JDBC URL validation using special Unicode characters whose case conversion differs between DataEase's validator and the H2 parser, smuggling dangerous parameters such as INIT into a malicious H2 connection string. Because H2's INIT clause executes SQL/DDL at connection time, an attacker can run arbitrary code on the host. No public exploit has been identified at time of analysis, but a fix commit and release exist, making the mechanism reproducible from the public patch.
Broken access control in DataEase before 2.10.24 lets any authenticated low-privilege user reach the /de2api/datasetData/previewSql endpoint, which is missing its mandatory @DePermit authorization check, and pass datasourceId=-1 to hit the built-in engine database and execute arbitrary SQL. This CWE-862 missing-authorization flaw exposes sensitive core application data and carries a CVSS 4.0 base score of 8.7 (High). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in DataEase before 2.10.24 allows an authenticated attacker to bypass the prior H2 zip-protocol and file-dropper hardening by uploading a ZIP archive masquerading as a font file (.ttf) via the FontManage.saveFile endpoint, then invoking the H2 database zip protocol against it to execute arbitrary code on the server. The flaw is a regression that defeats an earlier fix, and carries a CVSS 4.0 score of 8.7 (High). No public exploit has been identified at time of analysis, but the vendor GitHub Security Advisory (GHSA-8x36-774q-pwqg) and two remediation commits are published.
Arbitrary file deletion in DataEase (open-source data visualization and analytics platform) before 2.10.24 lets authenticated users delete arbitrary writable files inside the application container via a path traversal in the font management module. The stored fileTransName value is concatenated with the font storage directory and passed unsanitized to FileUtils.deleteFile() when a font record is deleted. No public exploit identified at time of analysis; the CVSS 4.0 base score is 7.2 (VI:H/VA:H), reflecting integrity and availability impact without confidentiality loss.
Unauthorized access to exported data in DataEase before 2.10.24 allows any authenticated user to enumerate and manipulate other users’ export tasks via Insecure Direct Object Reference (IDOR), and the download endpoint /exportCenter/download/{id} lacks authentication, enabling unauthenticated data exfiltration. Exploitation requires only a valid account (for IDOR actions) or none at all (for download), and while no public exploit or active exploitation is confirmed, the vulnerability is rated High with a CVSS 4.0 base score of 8.7 and EPSS probability of 0.39%.
Cross-workspace IDOR in SQLBot (DataEase) versions prior to 1.8.0 allows authenticated low-privilege users to read and modify database schemas and data sources belonging to other tenants via the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. The flaw breaks multi-tenant isolation in a Text-to-SQL platform that brokers access to backend databases, meaning a tenant can pivot to another tenant's data sources. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%), but SSVC rates technical impact as total.
Prompt injection in SQLBot 1.7.0 and earlier allows authenticated attackers to execute arbitrary SQL statements through the Text2SQL chat interface, escalating to remote code execution when connected to PostgreSQL databases via COPY FROM PROGRAM. The vulnerability stems from unsanitized user input being directly concatenated into LLM prompts, with resulting SQL executed without validation. CVSS 9.4 (Critical) reflects network-based attack with low complexity requiring only low-privilege authentication. SSVC framework confirms proof-of-concept availability and total technical impact, though exploitation is not fully automatable. Vendor-released patch 1.7.1 addresses the issue.
Remote code execution in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below allows an authenticated attacker to run arbitrary commands as root by abusing an unsafe Java deserialization path in the bundled Quartz 2.3.2 scheduler. Because Quartz reads job-data BLOBs from the qrtz_job_details table via ObjectInputStream with no class filter, and the shipped commons-collections-3.2.1 (pulled in by velocity-1.7.jar) exposes the InvokerTransformer gadget, an attacker who can write to the job table - e.g. by chaining the previously disclosed previewSql SQL injection - plants a CommonsCollections6 payload that fires when the cron trigger runs. SSVC rates technical impact as total with a proof-of-concept exploit; EPSS is low at 0.40% (61st percentile) and it is not in CISA KEV, so this is currently a PoC-stage rather than mass-exploited issue.
Authenticated SQL injection in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below lets an attacker with valid datasource credentials achieve full read and write access to a connected database via the /de2api/datasetData/previewSql endpoint. User-supplied SQL is wrapped in a subquery without enforcing a single SELECT, and a JDBC blocklist bypass re-enables allowMultiQueries=true, allowing stacked statements such as UPDATE. Publicly available exploit code exists (SSVC: PoC), but EPSS is only 0.03% and it is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.
Arbitrary file read in DataEase (open-source data visualization and analytics platform) versions 2.10.20 and below lets an authenticated attacker exfiltrate sensitive files from the server host by abusing the MySQL datasource configuration. Because the Mysql class exposes an auto-generated public setter for its JDBC security blocklist (via Lombok @Data), a crafted JSON datasource payload replaces the blocklist with an empty list before validation, enabling dangerous JDBC parameters like allowLoadLocalInfile=true. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the technical chain is well-documented in the vendor GHSA advisory.
SQL injection in DataEase, the open-source data visualization and analytics platform, lets an authenticated attacker execute arbitrary SQL commands via the /datasource/getTableField endpoint in versions 2.10.20 and earlier. The getTableFiledSql method in CalciteProvider.java concatenates the tableName parameter into a query using String.format without parameterization, and the existing table-name validation is bypassed by registering an API datasource with a malicious deTableName that getTables returns as legitimate. Publicly available exploit code exists per the SSVC assessment, though EPSS remains very low (0.03%, 8th percentile) and it is not in CISA KEV; it is one of a cluster of SQLi issues patched together in 2.10.21.
SQL injection in DataEase (versions ≤ 2.10.20) lets an authenticated user run arbitrary SQL against the backing database through the API datasource update endpoint. The attacker-controlled deTableName field is dropped into a CREATE TABLE statement without escaping, yielding error-based injection that can extract database contents. A proof-of-concept is indicated by CISA SSVC, though EPSS remains very low (0.03%) and it is not on CISA KEV; fixed in 2.10.21.
SQL injection in DataEase, the open-source data visualization and analytics platform, allows an authenticated user to execute arbitrary SQL through the API datasource save workflow in all versions up to and including 2.10.20. The flaw stems from the Base64-encoded 'deTableName' value being spliced into a DDL statement via unsanitized string replacement, letting an attacker break out of identifier quoting to run error-based injection that leaks backend database details such as the MySQL version. SSVC rates the technical impact as total and automatable, though publicly available exploit code exists only as a proof of concept and EPSS remains very low (0.03%); the issue is fixed in 2.10.21.
SQL injection in DataEase, an open-source data visualization and analytics platform, lets an authenticated user inject arbitrary SQL via the sort parameter of the datasetData enum-value endpoint, achieving time-based blind SQL injection against the backing database. All versions 2.10.20 and below are affected, with a total-impact potential to read, alter, or disrupt data. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not listed in CISA KEV, but the technical impact is rated total.
SQL injection in DataEase, an open-source data visualization and analytics platform, allows an authenticated user to inject arbitrary SQL through the orderDirection sorting parameter on dataset endpoints (/de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset) in versions 2.10.20 and below. Because the Order2SQLObj class places the raw value directly into the ORDER BY clause via StringTemplate with no whitelist, an attacker can perform time-based blind data extraction and denial of service. Publicly available exploit code exists (SSVC exploitation: poc); it is not in CISA KEV and the EPSS probability is very low (0.03%). Fixed in version 2.10.21.
SQL injection in DataEase's dataset export endpoint (POST /de2api/datasetTree/exportDataset) lets an authenticated attacker inject arbitrary SQL through the expressionTree parameter in versions 2.10.20 and below. User-controlled values in 'like' filter terms are concatenated unsanitized into SQL during filter-tree translation, enabling blind, time-based extraction of database contents. Publicly available exploit code exists (SSVC: poc); EPSS is low (0.03%, 8th percentile) and the flaw is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.
DataEase versions 2.10.19 and below contain a locale-dependent validation bypass vulnerability that allows attackers to smuggle dangerous JDBC parameters past security filters. The flaw stems from inconsistent locale handling where DataEase's validation uses the JVM default locale while H2 JDBC always uses English locale, causing Turkish locale environments to misinterpret malicious parameters like 'iNIT' (bypassing blacklist as 'İNIT' while H2 executes it as 'INIT'). This has been confirmed as exploitable in real deployment scenarios and enables authenticated attackers with low privileges to achieve high-impact code execution or data access, though there is no evidence yet of active exploitation or public proof-of-concept.
Remote code execution in SQLBot 1.5.0 and below allows authenticated users to inject malicious prompts through unsanitized terminology uploads, enabling attackers to manipulate the LLM into generating arbitrary PostgreSQL commands executed with database privileges. The vulnerability stems from missing permission checks on the Excel upload API combined with inadequate semantic isolation when injecting user-controlled data into the system prompt. An attacker can exploit this to achieve code execution on the database or application server running as the postgres user.
Remote code execution in Dataease prior to version 2.10.20 allows authenticated attackers to execute arbitrary code by manipulating the IniFile parameter to load malicious JDBC configuration files through the Redshift driver. An attacker with valid credentials can exploit the aggressive configuration file discovery mechanism to inject dangerous JDBC properties and gain complete system compromise. No patch is currently available, leaving affected deployments vulnerable to this high-severity attack vector.
Dataease is an open source data visualization analysis tool. versions up to 2.10.20 is affected by sql injection.
DataEase data visualization tool prior to 2.10.19 uses MD5-hashed passwords without salting, allowing attackers to crack credentials and gain unauthorized access.
Stored cross-site scripting in DataEase up to version 2.10.26 allows an authenticated attacker to inject arbitrary JavaScript through the `tooltip.backgroundColor` parameter of the Symbolic Map chart component, executing in the browser of any user who views the affected visualization. The injection point is the `buildTooltip` function in `symbolic-map.ts`, where user-controlled chart styling attributes are rendered without sanitization. No patch has been released; the vendor had not responded to the responsible disclosure issue at time of reporting, and no public exploit code has been identified.
Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Missing object-level authorization across three REST API surfaces in DataEase before 2.10.26 enables authenticated platform users to read, modify, and delete resources owned by other users. The affected endpoints cover chart detail retrieval (ChartViewManege), dashboard linkage read and write operations (VisualizationLinkageService), and map geometry management (MapManage) - all of which accepted arbitrary resource identifiers without verifying the requesting user held any permission over the target resource. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low attack complexity makes horizontal privilege escalation straightforward for any authenticated user.
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.
Stored cross-site scripting in DataEase's template static resource pipeline allows authenticated users to persist malicious JavaScript inside SVG files served at the application's same origin, executing in victims' browsers upon resource access. Versions prior to 2.10.23 are affected; the root cause is that StaticResourceServer.saveFilesToServe and saveSingleFileToServe decoded attacker-supplied Base64 content and wrote it directly to disk without validating extension, MIME type, decoded bytes, or SVG scriptability. No public exploit code or CISA KEV listing exists at time of analysis, but the stored, same-origin nature of the XSS and the low bar for triggering it (any authenticated user) make this a meaningful risk in shared or multi-tenant DataEase deployments.
Stored XSS in DataEase dashboard text components allows any authenticated user with edit access to inject HTML containing executable event handlers that fire silently in the browser of every subsequent dashboard viewer, including unauthenticated shared-link recipients. All versions prior to 2.10.24 are affected due to the use of Vue's v-html directive to render stored component content without server-side sanitization. No public exploit or active exploitation has been confirmed at time of analysis; a vendor-released patch is available in version 2.10.24.
SQL injection in Dataease 2.10.20's Data Dashboard component allows authenticated high-privilege attackers to execute arbitrary SQL queries via the SqlparserUtils.transFilter function. The vulnerability requires administrative access (CVSS PR:H) but enables database manipulation including data exfiltration, modification, and potential service disruption. Public exploit code exists on GitHub (xpp3901/CVE_APPLY), lowering the barrier for exploitation despite the high privilege requirement. The CVSS base score of 4.7 reflects limited scope due to authentication requirements, though real-world impact depends on admin credential security.
Server-side request forgery (SSRF) in Dataease SQLBot up to version 1.6.0 allows high-privileged remote attackers to manipulate the 'address' argument in the Elasticsearch Handler component (get_es_data_by_http function), enabling unauthorized HTTP requests to internal or external systems. The vulnerability has publicly available exploit code and vendor-released patch version 1.7.0 addresses the issue.
Stored XSS in Dataease 2.10.19 and earlier allows authenticated users to upload malicious SVG files that bypass backend validation by lacking proper sanitization of event handlers and script-capable attributes. An attacker can exploit this vulnerability to execute arbitrary JavaScript in victims' browsers when they access the uploaded static resource, achieving persistent code execution. The vulnerability was patched in version 2.10.20.
Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Dataease is an open source data analytics and visualization platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dataease is an open-source data visualization and analysis platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dataease is an open source data analytics and visualization platform. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threat actor who uses a carefully crafted message that exploits this character conversion can cause remote code execution. The vulnerability has been fixed in v2.10.11. No known workarounds are available.
Auth bypass in DataEase via CVE-2025-49001 patch evasion. PoC available.
Auth bypass in DataEase BI tool before 2.10.10.
Critical authentication bypass vulnerability in DataEase (open-source BI/data visualization tool) versions prior to 2.10.10 that allows authenticated attackers to bypass input validation filters introduced in CVE-2025-46566's patch. By crafting malicious payloads that exploit `getUrlType()` logic to evade hostname filtering, attackers can construct arbitrary JDBC statements, leading to complete compromise of confidentiality, integrity, and availability. This is a patch bypass vulnerability with authenticated access required but severe impact potential; patch version 2.10.10 is available.
Critical authentication bypass vulnerability in DataEase (open-source BI/data visualization tool) affecting versions prior to 2.10.6, which allows authenticated users to read and deserialize arbitrary files through JDBC background connections. This represents a bypass of the patch for CVE-2025-27103, escalating the risk from the original vulnerability. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid credentials (PR:L). No public exploit code availability or active KEV listing has been confirmed, but the patch availability (v2.10.10) indicates vendor acknowledgment of active exploitation risk.
DataEase is an open-source BI tool alternative to Tableau. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
DataEase is an open-source BI tool alternative to Tableau. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source business analytics tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source business analytics tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization analysis tool. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source data visualization and analysis tool. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization and analysis tool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization and analysis tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization and analysis tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Path traversal on Windows-hosted DataEase instances allows unauthenticated remote attackers to read arbitrary files from the server filesystem by exploiting a filter bypass unique to the Windows backslash path separator. All DataEase versions prior to 2.10.23 on Windows are affected; the root cause is that string truncation logic blocks only the forward-slash but not the backslash, which Windows treats as an equivalent directory separator. No public exploit has been identified at time of analysis, but the vendor-confirmed CVSS 4.0 score of 8.7 with a network-accessible, no-privileges vector warrants immediate patching on any Windows deployment.
Authentication bypass via forged JWTs in DataEase, an open-source data visualization and BI tool, allows remote unauthenticated attackers to impersonate any user (including administrators) in enterprise deployments before version 2.10.23. The enterprise TokenFilter passes attacker-supplied X-DE-TOKEN values to a validator that checks only token presence and length, then decodes the JWT without verifying its signature, so tokens with a chosen uid and oid are accepted whenever the enterprise license is valid (licenseValid=true). CVSS 4.0 rates this 9.5 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated SQL injection in DataEase dashboard variables allows data compromise. DataEase versions prior to 2.10.23 fail to sanitize dashboard SQL variables for non-in and non-between operators,
Stored SQL injection in DataEase (open source data visualization/BI tool) versions prior to 2.10.23 allows an authenticated user who can define SQL-type datasets to persist malicious SQL through variable defaultValue entries, which later execute against the backend database whenever any user with dataset read permission opens the dataset. The flaw (CWE-89) enables reading and modifying arbitrary database data, and CVSS 4.0 rates it 8.7 (High). No public exploit has been identified at time of analysis, but the upstream fix commit is public, so exploitation prerequisites are well documented.
Arbitrary directory deletion in DataEase, an open-source data visualization and analysis platform, allows an authenticated user (PR:L) to abuse the export-center bulk delete API by injecting path traversal sequences (../) into task identifiers, which are passed unsanitized to ExportCenterManage.delete and used to recursively delete server directories. All releases prior to 2.10.23 are affected, and the fix in 2.10.23 constrains deletion to identifiers that exist as legitimate export tasks in the database. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but a full commit-level patch is publicly available which lowers the barrier to reverse-engineering an exploit.
Remote authenticated code execution in DataEase before 2.10.23 lets a low-privileged user abuse the Excel/datasource upload workflow to run arbitrary Java. By uploading a crafted payload.zip via /datasource/upload and defining an H2 datasource that references the archive through the zip: protocol, an attacker forces CalciteProvider.jdbcFetchResultField to execute a query that triggers precompiled Java aliases embedded in test.mv.db. The vendor CVSS 4.0 vector scores this 7.1 (confidentiality-only), but the underlying primitive is full arbitrary code execution; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary SQL read access in DataEase before 2.10.23 lets authenticated users abuse the SQL preview feature (/de2api/datasetData/previewSql) to run attacker-supplied queries against any configured datasource. Because DatasetDataManage.previewSql passes the decoded PreviewSqlDTO.sql straight into datasourceRequest.query and CalciteProvider.fetchResultField executes it via prepareStatement().executeQuery(), an attacker can read any table the datasource account can access and receive the rows in the preview response. No public exploit identified at time of analysis, but the fix commit and advisory are public, making the flaw easy to reverse-engineer.
Arbitrary file write in DataEase (open-source BI/data-visualization platform) before 2.10.23 lets an authenticated user (PR:L) abuse the /de2api/templateManage/save template-save endpoint to write attacker-controlled Base64 content to arbitrary filesystem paths. Because StaticResourceServer#saveFilesToServe extracted the filename using only a forward-slash split, crafted staticResource names containing traversal sequences or backslashes escaped the intended static-resource directory. No public exploit or CISA KEV listing is identified at time of analysis, though the fixing commit and advisory are public.
SQL injection in DataEase before 2.10.23 lets an authenticated low-privilege user compromise the backend datasource by abusing the datasource connection-status check, where io.dataease.datasource.provider.CalciteProvider#checkStatus concatenates the user-controlled configuration.getSchema() value into getTablesSql and runs it via executeQuery. Because the schema/owner string is embedded directly into metadata queries for DB2, SQL Server, PostgreSQL, Oracle and other datasources, an attacker who can create or edit a datasource can inject arbitrary SQL and read or alter data on the connected database. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor commit that replaces string concatenation with parameterized PreparedStatements.
Reflection-based remote code execution in DataEase before 2.10.23 lets an authenticated operator who can configure a Redshift datasource achieve arbitrary code execution on the server. The Redshift JDBC driver loads an attacker-controlled rsjdbc.ini from the system temp directory and honors a malicious socketFactory pointing at Spring's FileSystemXmlApplicationContext, turning a normal JDBC connection into a code-execution chain. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor has confirmed and patched the flaw in 2.10.23.
Insecure Direct Object Reference in DataEase before 2.10.24 lets a holder of any valid share-link token retrieve arbitrary datasets by tampering with the request body. The share-mode chart endpoint POST /de2api/chartData/getData validates only that sceneId matches the resourceId bound to the link token, but never checks that the supplied tableId and field IDs belong to the shared resource, so an attacker can swap in identifiers for datasets they were never granted. No public exploit is identified at time of analysis, but the flaw is trivially exploitable by anyone already given a legitimate share link.
Authentication bypass in DataEase open-source BI platform before 2.10.24 lets unauthenticated remote attackers who know a protected share UUID retrieve a valid X-DE-LINK-TOKEN from the /de2api/share/proxyInfo endpoint, because the token is issued before the share password or ticket is checked. With that token an attacker can call subsequent share APIs and read data behind password-protected dashboards without valid credentials. No public exploit identified at time of analysis; the flaw is fixed in 2.10.24.
SQL injection in DataEase before 2.10.24 lets an authenticated user inject arbitrary SQL into queries run against configured datasources by supplying malicious quota (chart aggregation) or Y-axis filter values. The flaw sits in Quota2SQLObj.getYWheres(), which embeds attacker-controlled filter values directly into generated SQL while skipping the literal validation and escaping that other filter paths enforce. No public exploit identified at time of analysis, but the fixing commit and GitHub Security Advisory publicly disclose the exact vulnerable code path.
Authentication bypass in DataEase before 2.10.24 lets remote attackers forge valid share-link JWTs because ShareSecretManage ships with a hardcoded signature key (link-pwd-fit2cloud). An attacker who has obtained any passwordless share can mint linkToken JWTs that pass TokenFilter verification and access backend resources as the original share creator, even after that share has been revoked. There is no public exploit identified at time of analysis, but the hardcoded key is disclosed in the advisory, making forgery trivial once the signing algorithm is known.
Arbitrary code execution in DataEase before 2.10.24 lets authenticated users bypass H2 JDBC URL validation using special Unicode characters whose case conversion differs between DataEase's validator and the H2 parser, smuggling dangerous parameters such as INIT into a malicious H2 connection string. Because H2's INIT clause executes SQL/DDL at connection time, an attacker can run arbitrary code on the host. No public exploit has been identified at time of analysis, but a fix commit and release exist, making the mechanism reproducible from the public patch.
Broken access control in DataEase before 2.10.24 lets any authenticated low-privilege user reach the /de2api/datasetData/previewSql endpoint, which is missing its mandatory @DePermit authorization check, and pass datasourceId=-1 to hit the built-in engine database and execute arbitrary SQL. This CWE-862 missing-authorization flaw exposes sensitive core application data and carries a CVSS 4.0 base score of 8.7 (High). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in DataEase before 2.10.24 allows an authenticated attacker to bypass the prior H2 zip-protocol and file-dropper hardening by uploading a ZIP archive masquerading as a font file (.ttf) via the FontManage.saveFile endpoint, then invoking the H2 database zip protocol against it to execute arbitrary code on the server. The flaw is a regression that defeats an earlier fix, and carries a CVSS 4.0 score of 8.7 (High). No public exploit has been identified at time of analysis, but the vendor GitHub Security Advisory (GHSA-8x36-774q-pwqg) and two remediation commits are published.
Arbitrary file deletion in DataEase (open-source data visualization and analytics platform) before 2.10.24 lets authenticated users delete arbitrary writable files inside the application container via a path traversal in the font management module. The stored fileTransName value is concatenated with the font storage directory and passed unsanitized to FileUtils.deleteFile() when a font record is deleted. No public exploit identified at time of analysis; the CVSS 4.0 base score is 7.2 (VI:H/VA:H), reflecting integrity and availability impact without confidentiality loss.
Unauthorized access to exported data in DataEase before 2.10.24 allows any authenticated user to enumerate and manipulate other users’ export tasks via Insecure Direct Object Reference (IDOR), and the download endpoint /exportCenter/download/{id} lacks authentication, enabling unauthenticated data exfiltration. Exploitation requires only a valid account (for IDOR actions) or none at all (for download), and while no public exploit or active exploitation is confirmed, the vulnerability is rated High with a CVSS 4.0 base score of 8.7 and EPSS probability of 0.39%.
Cross-workspace IDOR in SQLBot (DataEase) versions prior to 1.8.0 allows authenticated low-privilege users to read and modify database schemas and data sources belonging to other tenants via the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. The flaw breaks multi-tenant isolation in a Text-to-SQL platform that brokers access to backend databases, meaning a tenant can pivot to another tenant's data sources. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%), but SSVC rates technical impact as total.
Prompt injection in SQLBot 1.7.0 and earlier allows authenticated attackers to execute arbitrary SQL statements through the Text2SQL chat interface, escalating to remote code execution when connected to PostgreSQL databases via COPY FROM PROGRAM. The vulnerability stems from unsanitized user input being directly concatenated into LLM prompts, with resulting SQL executed without validation. CVSS 9.4 (Critical) reflects network-based attack with low complexity requiring only low-privilege authentication. SSVC framework confirms proof-of-concept availability and total technical impact, though exploitation is not fully automatable. Vendor-released patch 1.7.1 addresses the issue.
Remote code execution in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below allows an authenticated attacker to run arbitrary commands as root by abusing an unsafe Java deserialization path in the bundled Quartz 2.3.2 scheduler. Because Quartz reads job-data BLOBs from the qrtz_job_details table via ObjectInputStream with no class filter, and the shipped commons-collections-3.2.1 (pulled in by velocity-1.7.jar) exposes the InvokerTransformer gadget, an attacker who can write to the job table - e.g. by chaining the previously disclosed previewSql SQL injection - plants a CommonsCollections6 payload that fires when the cron trigger runs. SSVC rates technical impact as total with a proof-of-concept exploit; EPSS is low at 0.40% (61st percentile) and it is not in CISA KEV, so this is currently a PoC-stage rather than mass-exploited issue.
Authenticated SQL injection in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below lets an attacker with valid datasource credentials achieve full read and write access to a connected database via the /de2api/datasetData/previewSql endpoint. User-supplied SQL is wrapped in a subquery without enforcing a single SELECT, and a JDBC blocklist bypass re-enables allowMultiQueries=true, allowing stacked statements such as UPDATE. Publicly available exploit code exists (SSVC: PoC), but EPSS is only 0.03% and it is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.
Arbitrary file read in DataEase (open-source data visualization and analytics platform) versions 2.10.20 and below lets an authenticated attacker exfiltrate sensitive files from the server host by abusing the MySQL datasource configuration. Because the Mysql class exposes an auto-generated public setter for its JDBC security blocklist (via Lombok @Data), a crafted JSON datasource payload replaces the blocklist with an empty list before validation, enabling dangerous JDBC parameters like allowLoadLocalInfile=true. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the technical chain is well-documented in the vendor GHSA advisory.
SQL injection in DataEase, the open-source data visualization and analytics platform, lets an authenticated attacker execute arbitrary SQL commands via the /datasource/getTableField endpoint in versions 2.10.20 and earlier. The getTableFiledSql method in CalciteProvider.java concatenates the tableName parameter into a query using String.format without parameterization, and the existing table-name validation is bypassed by registering an API datasource with a malicious deTableName that getTables returns as legitimate. Publicly available exploit code exists per the SSVC assessment, though EPSS remains very low (0.03%, 8th percentile) and it is not in CISA KEV; it is one of a cluster of SQLi issues patched together in 2.10.21.
SQL injection in DataEase (versions ≤ 2.10.20) lets an authenticated user run arbitrary SQL against the backing database through the API datasource update endpoint. The attacker-controlled deTableName field is dropped into a CREATE TABLE statement without escaping, yielding error-based injection that can extract database contents. A proof-of-concept is indicated by CISA SSVC, though EPSS remains very low (0.03%) and it is not on CISA KEV; fixed in 2.10.21.
SQL injection in DataEase, the open-source data visualization and analytics platform, allows an authenticated user to execute arbitrary SQL through the API datasource save workflow in all versions up to and including 2.10.20. The flaw stems from the Base64-encoded 'deTableName' value being spliced into a DDL statement via unsanitized string replacement, letting an attacker break out of identifier quoting to run error-based injection that leaks backend database details such as the MySQL version. SSVC rates the technical impact as total and automatable, though publicly available exploit code exists only as a proof of concept and EPSS remains very low (0.03%); the issue is fixed in 2.10.21.
SQL injection in DataEase, an open-source data visualization and analytics platform, lets an authenticated user inject arbitrary SQL via the sort parameter of the datasetData enum-value endpoint, achieving time-based blind SQL injection against the backing database. All versions 2.10.20 and below are affected, with a total-impact potential to read, alter, or disrupt data. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not listed in CISA KEV, but the technical impact is rated total.
SQL injection in DataEase, an open-source data visualization and analytics platform, allows an authenticated user to inject arbitrary SQL through the orderDirection sorting parameter on dataset endpoints (/de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset) in versions 2.10.20 and below. Because the Order2SQLObj class places the raw value directly into the ORDER BY clause via StringTemplate with no whitelist, an attacker can perform time-based blind data extraction and denial of service. Publicly available exploit code exists (SSVC exploitation: poc); it is not in CISA KEV and the EPSS probability is very low (0.03%). Fixed in version 2.10.21.
SQL injection in DataEase's dataset export endpoint (POST /de2api/datasetTree/exportDataset) lets an authenticated attacker inject arbitrary SQL through the expressionTree parameter in versions 2.10.20 and below. User-controlled values in 'like' filter terms are concatenated unsanitized into SQL during filter-tree translation, enabling blind, time-based extraction of database contents. Publicly available exploit code exists (SSVC: poc); EPSS is low (0.03%, 8th percentile) and the flaw is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.
DataEase versions 2.10.19 and below contain a locale-dependent validation bypass vulnerability that allows attackers to smuggle dangerous JDBC parameters past security filters. The flaw stems from inconsistent locale handling where DataEase's validation uses the JVM default locale while H2 JDBC always uses English locale, causing Turkish locale environments to misinterpret malicious parameters like 'iNIT' (bypassing blacklist as 'İNIT' while H2 executes it as 'INIT'). This has been confirmed as exploitable in real deployment scenarios and enables authenticated attackers with low privileges to achieve high-impact code execution or data access, though there is no evidence yet of active exploitation or public proof-of-concept.
Remote code execution in SQLBot 1.5.0 and below allows authenticated users to inject malicious prompts through unsanitized terminology uploads, enabling attackers to manipulate the LLM into generating arbitrary PostgreSQL commands executed with database privileges. The vulnerability stems from missing permission checks on the Excel upload API combined with inadequate semantic isolation when injecting user-controlled data into the system prompt. An attacker can exploit this to achieve code execution on the database or application server running as the postgres user.
Remote code execution in Dataease prior to version 2.10.20 allows authenticated attackers to execute arbitrary code by manipulating the IniFile parameter to load malicious JDBC configuration files through the Redshift driver. An attacker with valid credentials can exploit the aggressive configuration file discovery mechanism to inject dangerous JDBC properties and gain complete system compromise. No patch is currently available, leaving affected deployments vulnerable to this high-severity attack vector.
Dataease is an open source data visualization analysis tool. versions up to 2.10.20 is affected by sql injection.
DataEase data visualization tool prior to 2.10.19 uses MD5-hashed passwords without salting, allowing attackers to crack credentials and gain unauthorized access.
Stored cross-site scripting in DataEase up to version 2.10.26 allows an authenticated attacker to inject arbitrary JavaScript through the `tooltip.backgroundColor` parameter of the Symbolic Map chart component, executing in the browser of any user who views the affected visualization. The injection point is the `buildTooltip` function in `symbolic-map.ts`, where user-controlled chart styling attributes are rendered without sanitization. No patch has been released; the vendor had not responded to the responsible disclosure issue at time of reporting, and no public exploit code has been identified.
Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Missing object-level authorization across three REST API surfaces in DataEase before 2.10.26 enables authenticated platform users to read, modify, and delete resources owned by other users. The affected endpoints cover chart detail retrieval (ChartViewManege), dashboard linkage read and write operations (VisualizationLinkageService), and map geometry management (MapManage) - all of which accepted arbitrary resource identifiers without verifying the requesting user held any permission over the target resource. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low attack complexity makes horizontal privilege escalation straightforward for any authenticated user.
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.
Stored cross-site scripting in DataEase's template static resource pipeline allows authenticated users to persist malicious JavaScript inside SVG files served at the application's same origin, executing in victims' browsers upon resource access. Versions prior to 2.10.23 are affected; the root cause is that StaticResourceServer.saveFilesToServe and saveSingleFileToServe decoded attacker-supplied Base64 content and wrote it directly to disk without validating extension, MIME type, decoded bytes, or SVG scriptability. No public exploit code or CISA KEV listing exists at time of analysis, but the stored, same-origin nature of the XSS and the low bar for triggering it (any authenticated user) make this a meaningful risk in shared or multi-tenant DataEase deployments.
Stored XSS in DataEase dashboard text components allows any authenticated user with edit access to inject HTML containing executable event handlers that fire silently in the browser of every subsequent dashboard viewer, including unauthenticated shared-link recipients. All versions prior to 2.10.24 are affected due to the use of Vue's v-html directive to render stored component content without server-side sanitization. No public exploit or active exploitation has been confirmed at time of analysis; a vendor-released patch is available in version 2.10.24.
SQL injection in Dataease 2.10.20's Data Dashboard component allows authenticated high-privilege attackers to execute arbitrary SQL queries via the SqlparserUtils.transFilter function. The vulnerability requires administrative access (CVSS PR:H) but enables database manipulation including data exfiltration, modification, and potential service disruption. Public exploit code exists on GitHub (xpp3901/CVE_APPLY), lowering the barrier for exploitation despite the high privilege requirement. The CVSS base score of 4.7 reflects limited scope due to authentication requirements, though real-world impact depends on admin credential security.
Server-side request forgery (SSRF) in Dataease SQLBot up to version 1.6.0 allows high-privileged remote attackers to manipulate the 'address' argument in the Elasticsearch Handler component (get_es_data_by_http function), enabling unauthorized HTTP requests to internal or external systems. The vulnerability has publicly available exploit code and vendor-released patch version 1.7.0 addresses the issue.
Stored XSS in Dataease 2.10.19 and earlier allows authenticated users to upload malicious SVG files that bypass backend validation by lacking proper sanitization of event handlers and script-capable attributes. An attacker can exploit this vulnerability to execute arbitrary JavaScript in victims' browsers when they access the uploaded static resource, achieving persistent code execution. The vulnerability was patched in version 2.10.20.
Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Dataease is an open source data analytics and visualization platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dataease is an open-source data visualization and analysis platform. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dataease is an open source data analytics and visualization platform. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threat actor who uses a carefully crafted message that exploits this character conversion can cause remote code execution. The vulnerability has been fixed in v2.10.11. No known workarounds are available.
Auth bypass in DataEase via CVE-2025-49001 patch evasion. PoC available.
Auth bypass in DataEase BI tool before 2.10.10.
Critical authentication bypass vulnerability in DataEase (open-source BI/data visualization tool) versions prior to 2.10.10 that allows authenticated attackers to bypass input validation filters introduced in CVE-2025-46566's patch. By crafting malicious payloads that exploit `getUrlType()` logic to evade hostname filtering, attackers can construct arbitrary JDBC statements, leading to complete compromise of confidentiality, integrity, and availability. This is a patch bypass vulnerability with authenticated access required but severe impact potential; patch version 2.10.10 is available.
Critical authentication bypass vulnerability in DataEase (open-source BI/data visualization tool) affecting versions prior to 2.10.6, which allows authenticated users to read and deserialize arbitrary files through JDBC background connections. This represents a bypass of the patch for CVE-2025-27103, escalating the risk from the original vulnerability. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid credentials (PR:L). No public exploit code availability or active KEV listing has been confirmed, but the patch availability (v2.10.10) indicates vendor acknowledgment of active exploitation risk.
DataEase is an open-source BI tool alternative to Tableau. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
DataEase is an open-source BI tool alternative to Tableau. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source business intelligence and data visualization tool. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source business analytics tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source business analytics tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization analysis tool. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DataEase is an open source data visualization and analysis tool. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization and analysis tool. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DataEase is an open source data visualization analysis tool. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization and analysis tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DataEase is an open source data visualization and analysis tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.