dataease
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 15
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/09/2026, dataease recorded 15 security vulnerabilities in the last 90 days across 2 products, including 7 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, dataease had the most security vulnerabilities in the dataease ecosystem, with 9 vulnerabilities—approximately 60% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-32939DataEase is Vulnerable to H2 JDBC RCE BypassCVE-2026-32622SQLBot: Remote Code Execution via Terminology PoisoningCVE-2026-32140Dataease: Redshift JDBC RCE BypassCVE-2026-32139Dataease: Unfiltered active SVG content leads to Stored XSSCVE-2026-32137DataEase SQL Injection Vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-32939DataEase is Vulnerable to H2 JDBC RCE Bypass | Exploitation statusActively exploited | FixYes |
| Published03/20/2026 |
| SeverityHigh |
CVE-2026-32622SQLBot: Remote Code Execution via Terminology Poisoning | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published03/19/2026 | SeverityHigh |
|---|
CVE-2026-32140Dataease: Redshift JDBC RCE Bypass | Exploitation statusActively exploited | FixYes | Affected productdataease | Published03/12/2026 | SeverityCritical |
|---|
CVE-2026-32139Dataease: Unfiltered active SVG content leads to Stored XSS | Exploitation statusActively exploited | FixYes | Affected productdataease | Published03/12/2026 | SeverityMedium |
|---|
CVE-2026-32137DataEase SQL Injection Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published03/12/2026 | SeverityCritical |
|---|
CVE-2025-15598Dataease SQLBot JWT Token auth.py validateEmbedded signature verification | Exploitation statusActively exploited | FixNo | Affected productSQLBot | Published03/03/2026 | SeverityMedium |
|---|
CVE-2025-15597Dataease SQLBot API Endpoint assistant.py access control | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published03/02/2026 | SeverityMedium |
|---|
CVE-2026-23958DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover | Exploitation statusActively exploited | FixYes | Affected productdataease | Published01/22/2026 | SeverityHigh |
|---|
CVE-2025-69285SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability | Exploitation statusActively exploited | FixYes | Affected productSQLBot | Published01/21/2026 | SeverityHigh |
|---|
CVE-2025-64428DataEase DB2 JNDI Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published11/20/2025 | SeverityHigh |
|---|
CVE-2025-64164DataEase is vulnerable to Oracle JNDI Injection | Exploitation statusActively exploited | FixYes | Affected productdataease | Published11/06/2025 | SeverityHigh |
|---|
CVE-2025-64163DataEase's DB2 is vulnerable to SSRF | Exploitation statusActively exploited | FixYes | Affected productdataease | Published11/05/2025 | SeverityHigh |
|---|
CVE-2025-62422DataEase SQL injection vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published10/17/2025 | SeverityHigh |
|---|
CVE-2025-62421DataEase vulnerable to stored cross-site scripting via file upload bypass | Exploitation statusNot exploited | FixYes | Affected productdataease | Published10/17/2025 | SeverityMedium |
|---|
CVE-2025-62420DataEase vulnerable to remote code execution via H2 JDBC driver bypass | Exploitation statusActively exploited | FixYes | Affected productdataease | Published10/17/2025 | SeverityHigh |
|---|
CVE-2025-62419DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration | Exploitation statusNot exploited | FixYes | Affected productdataease | Published10/17/2025 | SeverityHigh |
|---|
CVE-2025-58748Dataease H2 data source JDBC URL validation bypass leads to remote code execution | Exploitation statusNot exploited | FixYes | Affected productdataease | Published09/15/2025 | SeverityHigh |
|---|
CVE-2025-58046Dataease has a JDBC attack vulnerability in the Impala datasource | Exploitation statusActively exploited | FixYes | Affected productdataease | Published09/15/2025 | SeverityHigh |
|---|
CVE-2025-58045Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter | Exploitation statusActively exploited | FixYes | Affected productdataease | Published09/15/2025 | SeverityHigh |
|---|
CVE-2025-57773Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published08/25/2025 | SeverityHigh |
|---|
CVE-2025-57772Dataease H2 JDBC RCE Bypass | Exploitation statusActively exploited | FixYes | Affected productdataease | Published08/25/2025 | SeverityHigh |
|---|
CVE-2025-53006Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/02/2025 | SeverityHigh |
|---|
CVE-2025-53005Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/01/2025 | SeverityHigh |
|---|
CVE-2025-53004Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/30/2025 | SeverityHigh |
|---|
CVE-2025-49003Dataease H2 JDBC Connection Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/26/2025 | SeverityHigh |
|---|
CVE-2025-49002Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/03/2025 | SeverityHigh |
|---|
CVE-2025-49001Dataease Authentication Bypass Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/03/2025 | SeverityHigh |
|---|
CVE-2025-48999Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability | Exploitation statusActively exploited | FixNo | Affected productdataease | Published06/03/2025 | SeverityMedium |
|---|
CVE-2025-48998Dataease MYSQL JDBC File Reading Vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/03/2025 | SeverityHigh |
|---|
CVE-2025-46566Dataease redshift JDBC Connection Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productdataease | Published05/01/2025 | SeverityMedium |
|---|
CVE-2025-32966Dataease H2 JDBC Connection Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productdataease | Published04/23/2025 | SeverityHigh |
|---|
CVE-2025-27138DataEase has an improper authentication vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published03/13/2025 | SeverityHigh |
|---|
CVE-2025-27103Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published03/13/2025 | SeverityHigh |
|---|
CVE-2025-24974DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published03/13/2025 | SeverityHigh |
|---|
CVE-2024-56511DataEase has an unauthorized vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published01/10/2025 | SeverityCritical |
|---|
CVE-2024-55953Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published12/18/2024 | SeverityHigh |
|---|
CVE-2024-55952Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published12/18/2024 | SeverityHigh |
|---|
CVE-2024-52295DataEase has a forged JWT token vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published11/13/2024 | SeverityCritical |
|---|
CVE-2024-47073Dataease arbitrary interface access vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published11/07/2024 | SeverityCritical |
|---|
CVE-2024-47074Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published10/11/2024 | SeverityCritical |
|---|
CVE-2024-46997DataEase's H2 datasource has a remote command execution risk | Exploitation statusNot exploited | FixYes | Affected productdataease | Published09/23/2024 | SeverityCritical |
|---|
CVE-2024-46985DataEase has an XXE vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published09/23/2024 | SeverityHigh |
|---|
CVE-2024-31441Arbitrary File Reading in DataEase | Exploitation statusActively exploited | FixYes | Affected productdataease | Published05/10/2024 | SeverityHigh |
|---|
CVE-2024-30269DataEase has database configuration information exposure vulnerability | Exploitation statusNot exploited | FixYes | Affected productdataease | Published04/08/2024 | SeverityMedium |
|---|
CVE-2024-23328The Dataease datasource exists deserialization and arbitrary file read vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published02/01/2024 | SeverityCritical |
|---|
CVE-2023-40183DataEase has a vulnerability to obtain user cookies | Exploitation statusActively exploited | FixYes | Affected productdataease | Published09/21/2023 | SeverityHigh |
|---|
CVE-2023-37258DataEase has a SQL injection vulnerability that can bypass blacklists | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/25/2023 | SeverityHigh |
|---|
CVE-2023-37257The DataEase panel and dataset have a stored XSS vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published07/25/2023 | SeverityMedium |
|---|
CVE-2023-35168DataEase has a privilege bypass vulnerability | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/26/2023 | SeverityMedium |
|---|
CVE-2023-35164Unauthorized users can manipulate a dashboard created by an administrator in DataEase | Exploitation statusActively exploited | FixYes | Affected productdataease | Published06/26/2023 | SeverityMedium |
|---|
108 Results | Page 2 of 3