CVEs we hold for Dataease

Records whose assigning authority named Dataease as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-93660SQLBot through 1.10.1 Improper Access Control via Dashboard Updatedataease SQLBot

CVE-2026-90529DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scriptingn/a DataEase

CVE-2026-8724Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injectionn/a Dataease

CVE-2026-82879DataEase before 2.10.26 Access Control Bypass via Share Ticketsdataease

CVE-2026-82878DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpointsdataease

CVE-2026-72743SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-htmldataease SQLBot

CVE-2026-57172DataEase: Hardcoded JWT Signing Secret in ShareLinkdataease

CVE-2026-55647DataEase: authenticated stored XSS in the dashboard text componentsdataease

CVE-2026-55635DataEase: Authenticated SQL Injection in Chart Quota Filtersdataease

CVE-2026-55633DataEase H2 RCE via Zip Protocol & File Dropper Fix bypassdataease

CVE-2026-55631DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Managementdataease

CVE-2026-5417Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgeryDataease SQLbot

CVE-2026-53751DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)dataease

CVE-2026-53730DataEase: Unauthorized Access to Engine Database via previewSql Endpointdataease

CVE-2026-53729DataEase ExportCenter IDOR allows cross-user export task accessdataease

CVE-2026-53557SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Executiondataease SQLBot

CVE-2026-53556SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Readdataease SQLBot

CVE-2026-53555Stored XSS via SVG Uploaddataease SQLBot

CVE-2026-53554SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processingdataease SQLBot

CVE-2026-50530DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasetsdataease

CVE-2026-50529DataEase: Link Token Leakage Prior to Share Password/Ticket Validationdataease

CVE-2026-50124DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropperdataease

CVE-2026-50030DataEase: Arbitrary SQL execution in preview path (direct data disclosure)dataease

CVE-2026-49867DataEase: Authenticated Stored XSS in DataEase Template Static Resourcesdataease

CVE-2026-46684DataEase: Unauthorized Command Execution Vulnerabilitydataease

CVE-2026-45535DataEase: Stored SQL Injection Vulnerabilitydataease

CVE-2026-45534DataEase: RCE Vulnerabilitydataease

CVE-2026-45533DataEase: Path Traversal Vulnerabilitydataease

CVE-2026-45532DataEase has a Path Traversal Vulnerabilitydataease

CVE-2026-45419DataEase: Arbitrary File Write Vulnerabilitydataease

CVE-2026-45417DataEase: SQL injection vulnerabilitydataease

CVE-2026-45320DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injectiondataease

CVE-2026-42463SQLBot: Unauthorized Access Vulnerabilitydataease SQLBot

CVE-2026-40901DataEase: Quartz Deserialization → Remote Code Executiondataease

CVE-2026-40900DataEase has SQL Injection via Stacked Queriesdataease

CVE-2026-40899DataEase has an Arbitrary File Read Vulnerabilitydataease

CVE-2026-33324SQLBot prompt injection allows arbitrary SQL execution and remote code executiondataease SQLBot

CVE-2026-33207DataEase SQL Injection Vulnerabilitydataease

CVE-2026-33122DataEase has SQL Injection via Datasource Managementdataease

CVE-2026-33121DataEase has SQL Injection via Datasource Save Flowdataease

CVE-2026-33084DataEase has SQL Injection through its getFieldEnumObj Endpointdataease

CVE-2026-33083DataEase has SQL Injection in Order By Clausedataease

CVE-2026-33082DataEase: SQL Injection in v2 Dataset Exportdataease

CVE-2026-32950SQLBot: RCE via SQL Injection in Excel Upload Endpointdataease SQLBot

CVE-2026-32949SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQLdataease SQLBot

CVE-2026-32939DataEase is Vulnerable to H2 JDBC RCE Bypassdataease

CVE-2026-32622SQLBot: Remote Code Execution via Terminology Poisoningdataease SQLBot

CVE-2026-32140Dataease: Redshift JDBC RCE Bypassdataease

CVE-2026-32139Dataease: Unfiltered active SVG content leads to Stored XSSdataease

CVE-2026-32137DataEase SQL Injection Vulnerabilitydataease

CVE-2026-23958DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeoverdataease

CVE-2025-69285SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerabilitydataease SQLBot

CVE-2025-64428DataEase DB2 JNDI Vulnerabilitydataease

CVE-2025-64164DataEase is vulnerable to Oracle JNDI Injectiondataease

CVE-2025-64163DataEase's DB2 is vulnerable to SSRFdataease

CVE-2025-62422DataEase SQL injection vulnerabilitydataease

CVE-2025-62421DataEase vulnerable to stored cross-site scripting via file upload bypassdataease

CVE-2025-62420DataEase vulnerable to remote code execution via H2 JDBC driver bypassdataease

CVE-2025-62419DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configurationdataease

CVE-2025-58748Dataease H2 data source JDBC URL validation bypass leads to remote code executiondataease

CVE-2025-58046Dataease has a JDBC attack vulnerability in the Impala datasourcedataease

CVE-2025-58045Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameterdataease

CVE-2025-57773Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerabilitydataease

CVE-2025-57772Dataease H2 JDBC RCE Bypassdataease

CVE-2025-53006Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease

CVE-2025-53005Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease

CVE-2025-53004Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease

CVE-2025-49003Dataease H2 JDBC Connection Remote Code Executiondataease

CVE-2025-49002Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerabilitydataease

CVE-2025-49001Dataease Authentication Bypass Vulnerabilitydataease

CVE-2025-48999Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerabilitydataease

CVE-2025-48998Dataease MYSQL JDBC File Reading Vulnerabilitydataease

CVE-2025-46566Dataease redshift JDBC Connection Remote Code Executiondataease

CVE-2025-32966Dataease H2 JDBC Connection Remote Code Executiondataease

CVE-2025-27138DataEase has an improper authentication vulnerabilitydataease

CVE-2025-27103Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerabilitydataease

CVE-2025-24974DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerabilitydataease

CVE-2025-15598Dataease SQLBot JWT Token auth.py validateEmbedded signature verificationDataease SQLBot

CVE-2025-15597Dataease SQLBot API Endpoint assistant.py access controlDataease SQLBot

CVE-2024-56511DataEase has an unauthorized vulnerabilitydataease

CVE-2024-55953Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerabilitydataease

CVE-2024-55952Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerabilitydataease

CVE-2024-52295DataEase has a forged JWT token vulnerabilitydataease

CVE-2024-47074Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerabilitydataease

CVE-2024-47073Dataease arbitrary interface access vulnerabilitydataease

CVE-2024-46997DataEase's H2 datasource has a remote command execution riskdataease

CVE-2024-46985DataEase has an XXE vulnerabilitydataease

CVE-2024-31441Arbitrary File Reading in DataEasedataease

CVE-2024-30269DataEase has database configuration information exposure vulnerabilitydataease

CVE-2024-23328The Dataease datasource exists deserialization and arbitrary file read vulnerabilitydataease

CVE-2023-40772no title heldDataEase

CVE-2023-40183DataEase has a vulnerability to obtain user cookiesdataease

CVE-2023-37258DataEase has a SQL injection vulnerability that can bypass blacklistsdataease

CVE-2023-37257The DataEase panel and dataset have a stored XSS vulnerabilitydataease

CVE-2023-35168DataEase has a privilege bypass vulnerabilitydataease

CVE-2023-35164Unauthorized users can manipulate a dashboard created by an administrator in DataEasedataease

CVE-2023-34463Unauthorized users can delete applications in DataEasedataease

CVE-2023-33963DataEase data source has deserialization vulnerabilitydataease

CVE-2023-32310DataEase API interface has IDOR vulnerabilitydataease

CVE-2023-28637DataEase AWS redshift data source exists for remote code execution vulnerabilitydataease

CVE-2023-28437SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypasseddataease

CVE-2023-28435Dataease file upload interface does not verify permission or file typedataease

CVE-2023-25807DataEase dashboard has a stored XSS vulnerabilitydataease

CVE-2022-39312Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerabilitydataease

104 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.