Vendor
dataease
110 known vulnerabilities.
dataease at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 3 | 0 |
| Oct 2026 | 5 | 0 |
| Sep 2026 | 6 | 0 |
| Aug 2026 | 4 | 0 |
| Jul 2026 | 20 | 2 |
| Jun 2026 | 0 | 0 |
| May 2026 | 2 | 1 |
| Apr 2026 | 10 | 0 |
| Mar 2026 | 9 | 2 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 4 | 0 |
| Sep 2025 | 3 | 0 |
| Aug 2025 | 2 | 0 |
| Jul 2025 | 2 | 0 |
| Jun 2025 | 6 | 0 |
| May 2025 | 1 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 3 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 1 | 1 |
| Dec 2024 | 2 | 0 |
Products
110 results · Feed
-
Medium 5.3
A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSv…
-
Medium 6.9
A security vulnerability has been detected in DataEase up to 2.10.27/3.1.0. Affected is the function ExtWhere2Str.extWh…
-
Low 2.7
SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV…
-
Medium 5.1
DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs…
-
Medium 5.1
DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the cate…
-
High 8.7
DataEase: Stored SQL Injection via dateFormat field templates
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates use…
-
High 8.7
DataEase: Stored SQL Injection in group-field binning bounds
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions.…
-
High 8.7
DataEase: SQL Injection in datasource metadata identifiers
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate,…
-
Medium 6.5
SQLBot through 1.10.1 Improper Access Control via Dashboard Update
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and…
-
High 7.7
SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBo…
-
Medium 5.1
Stored XSS via SVG Upload
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing…
-
Medium 6.0
SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_name value into generat…
-
High 7.3
SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting wh…
-
Medium 4.3
A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information…
-
Medium 6.3
DataEase before 2.10.26 Access Control Bypass via Share Tickets
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/…
-
Medium 6.3
DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete…
-
High 8.7
DataEase has a Path Traversal Vulnerability
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the `FILE_SEPARATOR` is `\`, while the server only filters the `/` character during string trunc…
-
Medium 5.4
SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inje…
-
Medium 6.3
DataEase: Authenticated Stored XSS in DataEase Template Static Resources
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decom…
-
Critical 9.5
DataEase: Unauthorized Command Execution Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByTo…
-
High 8.7
DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between operators…
-
High 8.7
DataEase: Stored SQL Injection Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as ${var} and SqlparserUtils.handleVariableDefaultValue() inserts them with String.r…
-
High 8.3
DataEase: Path Traversal Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.d…
-
High 7.1
DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL …
-
High 7.1
DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and Previe…
-
High 8.5
DataEase: Arbitrary File Write Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServer#saveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticReso…
-
High 8.7
DataEase: SQL injection vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.p…
-
Critical 9.0
DataEase: RCE Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc.ini configuration from System.getProperty("java.io.tmpdir"), setting socketFactory=org.springframew…
-
High 7.1
DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body b…
-
High 8.7
DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a …
-
Medium 5.1
DataEase: authenticated stored XSS in the dashboard text components
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component…
-
High 8.7
DataEase: Authenticated SQL Injection in Chart Quota Filters
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and …
-
High 8.3
DataEase: Hardcoded JWT Signing Secret in ShareLink
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-…
-
High 8.7
DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, all…
-
High 8.7
DataEase: Unauthorized Access to Engine Database via previewSql Endpoint
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access t…
-
High 8.7
DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and th…
-
High 7.2
DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenat…
-
High 8.7
DataEase ExportCenter IDOR allows cross-user export task access
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/ge…
-
High 8.6
SQLBot: Unauthorized Access Vulnerability
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /…
-
Critical 9.4
SQLBot prompt injection allows arbitrary SQL execution and remote code execution
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt…