dataease
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 15
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, dataease recorded 15 security vulnerabilities in the last 90 days across 2 products, including 7 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, dataease had the most security vulnerabilities in the dataease ecosystem, with 9 vulnerabilities—approximately 60% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121453SQLBot through 1.10.3 Path Traversal via datasource importToDb EndpointCVE-2026-104143DataEase: Stored SQL Injection via dateFormat field templatesCVE-2026-104142DataEase: Stored SQL Injection in group-field binning boundsCVE-2026-104141DataEase: SQL Injection in datasource metadata identifiersCVE-2026-102756DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-121453SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint | Exploitation statusNot exploited | FixYes |
| Published11/03/2026 |
| SeverityMedium |
CVE-2026-104143DataEase: Stored SQL Injection via dateFormat field templates | Exploitation statusNot exploited | FixYes | Affected productdataease | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-104142DataEase: Stored SQL Injection in group-field binning bounds | Exploitation statusActively exploited | FixYes | Affected productdataease | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-104141DataEase: SQL Injection in datasource metadata identifiers | Exploitation statusActively exploited | FixNo | Affected productdataease | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-102756DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting | Exploitation statusActively exploited | FixYes | Affected productdataease | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-102755DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting | Exploitation statusActively exploited | FixYes | Affected productdataease | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-93660SQLBot through 1.10.1 Improper Access Control via Dashboard Update | Exploitation statusNot exploited | FixYes | Affected productSQLBot | Published09/18/2026 | SeverityHigh |
|---|
CVE-2026-53557SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution | Exploitation statusNot exploited | FixYes | Affected productSQLBot | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-53556SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-53555Stored XSS via SVG Upload | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-53554SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published09/17/2026 | SeverityHigh |
|---|
CVE-2023-40772CVE-2023-40772 | Exploitation statusActively exploited | FixYes | Affected productdataease | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-82879DataEase before 2.10.26 Access Control Bypass via Share Tickets | Exploitation statusNot exploited | FixYes | Affected productdataease | Published08/31/2026 | SeverityMedium |
|---|
CVE-2026-82878DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints | Exploitation statusNot exploited | FixYes | Affected productdataease | Published08/31/2026 | SeverityMedium |
|---|
CVE-2026-45532DataEase has a Path Traversal Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-72743SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published08/10/2026 | SeverityMedium |
|---|
CVE-2026-50124DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-50030DataEase: Arbitrary SQL execution in preview path (direct data disclosure) | Exploitation statusNot exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-49867DataEase: Authenticated Stored XSS in DataEase Template Static Resources | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityMedium |
|---|
CVE-2026-46684DataEase: Unauthorized Command Execution Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityCritical |
|---|
CVE-2026-45535DataEase: Stored SQL Injection Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-45534DataEase: RCE Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityCritical |
|---|
CVE-2026-45533DataEase: Path Traversal Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-45419DataEase: Arbitrary File Write Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-45417DataEase: SQL injection vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-45320DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/15/2026 | SeverityHigh |
|---|
CVE-2026-57172DataEase: Hardcoded JWT Signing Secret in ShareLink | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-55647DataEase: authenticated stored XSS in the dashboard text components | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-55635DataEase: Authenticated SQL Injection in Chart Quota Filters | Exploitation statusNot exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-55633DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-55631DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-53751DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE) | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-53730DataEase: Unauthorized Access to Engine Database via previewSql Endpoint | Exploitation statusNot exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-53729DataEase ExportCenter IDOR allows cross-user export task access | Exploitation statusNot exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-50530DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-50529DataEase: Link Token Leakage Prior to Share Password/Ticket Validation | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-42463SQLBot: Unauthorized Access Vulnerability | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-33324SQLBot prompt injection allows arbitrary SQL execution and remote code execution | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published05/05/2026 | SeverityCritical |
|---|
CVE-2026-40901DataEase: Quartz Deserialization → Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-40900DataEase has SQL Injection via Stacked Queries | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-40899DataEase has an Arbitrary File Read Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-33207DataEase SQL Injection Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-33122DataEase has SQL Injection via Datasource Management | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-33121DataEase has SQL Injection via Datasource Save Flow | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-33084DataEase has SQL Injection through its getFieldEnumObj Endpoint | Exploitation statusNot exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-33083DataEase has SQL Injection in Order By Clause | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-33082DataEase: SQL Injection in v2 Dataset Export | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/16/2026 | SeverityHigh |
|---|
CVE-2026-5417Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published04/02/2026 | SeverityMedium |
|---|
CVE-2026-32950SQLBot: RCE via SQL Injection in Excel Upload Endpoint | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published03/20/2026 | SeverityHigh |
|---|
CVE-2026-32949SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published03/20/2026 | SeverityHigh |
|---|
108 Results | Page 1 of 3