Vulnerabilities

TI-2025-36199 CVE-2025-58441

Knowage is vulnerable to blind server-side request forgery (SSRF)

LOW 33

Knowage is an open source analytics and business intelligence suite.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00189 Published 2026-01-07 Fixed in 8.1.37 CWE-918

TI-2025-37342 CVE-2025-59954

Knowage Contains a Remote Code Execution Vulnerability

HIGH 81

Knowage is an open source analytics and business intelligence suite.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00549 Published 2025-09-29 Fixed in 8.1.27 CWE-94

TI-2025-34710 CVE-2025-55007

Knowage vulnerable to server-side request forgery

LOW 23

Knowage is an open source analytics and business intelligence suite.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00193 Published 2025-09-01 Fixed in 8.1.37 CWE-918

TI-2023-20050 CVE-2023-38702

Knowage Server vulnerable to path traversal via upload functionality

HIGH 76

Knowage is an open source analytics and business intelligence suite.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01172 Published 2023-08-04 Fixed in 8.1.8 CWE-22

TI-2023-19080 CVE-2023-37472

Query injection in Knowage server

HIGH 67

Knowage is an open source suite for business analytics.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00706 Published 2023-07-14 Fixed in 8.1.8 CWE-89

TI-2023-18613 CVE-2023-36819

Knowage-Server vulnerable to Path traversal in download functionalities

MEDIUM 62

Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00791 Published 2023-07-03 Fixed in 8.1.8 CWE-22

TI-2023-17600 CVE-2023-35154

Knowage-Server vulnerable to account validation bypass

HIGH 71

Knowage is an open source analytics and business intelligence suite.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0038 Published 2023-06-23 Fixed in 8.1.8 CWE-287

TI-2022-18671 CVE-2022-39295

Improper Neutralization of Alternate XSS Syntax in Knowage-Server

MEDIUM 60

Knowage is an open source suite for modern business analytics alternative over big data systems.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00714 Published 2022-10-13 Fixed in 7.4.22, 8.0.9 CWE-79

TI-2021-10742 CVE-2021-30213 · GHSA-rhgp-mf49-p5gr

Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS).

LOW 32

Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02721 Published 2021-05-12 No fix listed CWE-79

TI-2021-10743 CVE-2021-30214 · GHSA-hwrw-j4pc-89pr

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in…

MEDIUM 45

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.23795 Published 2021-05-12 No fix listed CWE-74

TI-2021-10741 CVE-2021-30212 · GHSA-w852-vpw3-jf4v

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS).

LOW 25

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2021-05-12 No fix listed CWE-79

TI-2021-10740 CVE-2021-30211 · GHSA-8rrr-rr37-wgfc

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS).

LOW 25

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00499 Published 2021-05-12 No fix listed CWE-79

TI-2021-10639 CVE-2021-30055 · GHSA-p8qf-chx8-32g2

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the…

MEDIUM 41

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01602 Published 2021-04-05 No fix listed CWE-89

TI-2021-10640 CVE-2021-30056 · GHSA-2w6j-f6vj-9w6f

Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS).

LOW 25

Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00616 Published 2021-04-05 No fix listed CWE-79

TI-2021-10641 CVE-2021-30057 · GHSA-wp3m-vvf5-j4v8

A stored HTML injection vulnerability exists in Knowage Suite version 7.1.

LOW 23

A stored HTML injection vulnerability exists in Knowage Suite version 7.1.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0066 Published 2021-04-05 No fix listed CWE-74

TI-2021-10642 CVE-2021-30058 · GHSA-9m4q-9h42-w37g

Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS).

LOW 29

Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00994 Published 2021-04-05 No fix listed CWE-79

TI-2019-09881 CVE-2019-13188 · GHSA-p8c6-fx85-c47c

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

MEDIUM 47

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02462 Published 2019-09-05 No fix listed CWE-287

TI-2019-09883 CVE-2019-13190 · GHSA-h2j8-mg54-r682

In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token.

LOW 27

In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01387 Published 2019-09-05 No fix listed CWE-287

TI-2019-10029 CVE-2019-13348 · GHSA-h3q3-rm4g-pqjh

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will…

MEDIUM 41

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01467 Published 2019-08-28 No fix listed CWE-522

TI-2019-09882 CVE-2019-13189 · GHSA-mc6p-vg7m-2x3q

In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.

LOW 29

In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00943 Published 2019-08-28 No fix listed CWE-79

TI-2018-08856 CVE-2018-12355 · GHSA-89g4-q822-44j2

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the…

LOW 29

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00768 Published 2018-06-13 No fix listed CWE-79

Vulnerabilities

Filters