Skip to content
OpenAdvisories

Product · gcpaas

DataRoom

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-125381

    DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql

    DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting…

    gcpaas DataRoom
  • Medium 6.5
    CVE-2026-125380

    DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test

    DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT …

    gcpaas DataRoom