6 matches found
EUVD-2026-120544
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...
CVE-2026-125381: gcpaas DataRoom: DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role…
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...
CVE-2026-125381 DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...
CVE-2026-125381
DataRoom versions up to and including 3.0.0 are vulnerable to an SQL injection in the MyBatisService.generateSql component. This flaw allows users with the sharer-role to execute arbitrary SQL commands against the database by providing crafted dataset parameters via the /dataRoom/dataset/run endp...
CVE-2026-125381 DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...
PT-2026-141204
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...