Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

117 records

Vendor: dataease Clear all filters
TI-2026-84346 CVE-2026-121453 · GHSA-fghj-qqgj-7rxf

Path traversal in SQLBot datasource import lets admins read files

Priority LOW 24

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00436 Published 2026-11-03 No fix listed CWE-22
TI-2026-63092 CVE-2026-93660 · GHSA-wx4g-wvfp-r25g

SQLBot through 1.10.1 Improper Access Control via Dashboard Update

Priority LOW 32

SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0043 Published 2026-09-18 No fix listed CWE-639
TI-2026-38626 CVE-2026-53555

Stored XSS via SVG Upload

Priority MEDIUM 56

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00483 Published 2026-09-17 Fixed in 1.9.0 CWE-79
TI-2023-21541 CVE-2023-40772

Path traversal in DataEase

Priority MEDIUM 53

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00947 Published 2026-09-14 Fixed in 1.18.10 CWE-23
TI-2026-57182 CVE-2026-82878 · GHSA-v7cf-2ghm-9jxr

DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints

Priority LOW 24

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other u…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00344 Published 2026-08-31 Fixed in 2.10.26 CWE-862
TI-2026-50978 CVE-2026-72743 · GHSA-vm6h-rfrh-ph3m

SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

Priority LOW 23

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00298 Published 2026-08-10 Fixed CWE-79
TI-2026-33285 CVE-2026-45533

DataEase: Path Traversal Vulnerability

Priority HIGH 69

DataEase is an open source data visualization and analysis tool.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00459 Published 2026-07-15 Fixed in 2.10.23 CWE-22
TI-2026-33206 CVE-2026-45417

DataEase: SQL injection vulnerability

Priority HIGH 73

DataEase is an open source data visualization and analysis tool.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00377 Published 2026-07-15 Fixed in 2.10.23 CWE-89
Load more