CVE-2025-55673

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

GHSA-9G5X-MM39-WG9R Apache Superset data query improperly discloses database schema information to low-privileged guest user

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the query field in the API response from the /chart/data endpoint. An...

Apache Superset data query improperly discloses database schema information to low-privileged guest user

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

CVE-2025-55673

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. Thi...

Apache Superset 信息泄露漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from an information disclosure vulnerability that stems from the /chart/data endpoint response containing underlying query information, which can be exploited by an attack...

PT-2025-32480 · Zhilink 智互联(深圳)科技有限公司 · Adp Application Developer Platform

Name of the Vulnerable Software and Affected Versions: zhilink 智互联深圳科技有限公司 ADP Application Developer Platform version 1.0.0 Description: A critical issue exists in the zhilink 智互联深圳科技有限公司 ADP Application Developer Platform. The vulnerability is due to a SQL injection that can be triggered by...

n8n Vulnerable to Denial of Service via Malformed Binary Data Requests

Summary Denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs filesystem:// or filesystem-v2://. Impact This is a Denial of Service DoS vulnerability that allows authenticated attackers to cause service unavailability through malformed filesystem URI...

CVE-2025-2321

A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to business logic errors. The attack may be...

SAP Fiori 安全漏洞

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. A security...

CVE-2024-0765

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

PT-2024-39280

Name of the Vulnerable Software and Affected Versions: h2oai h2o-3 version 3.46.0.4 Description: A critical issue has been found in the getConnectionSafe function of the component JDBC Connection Handler, affecting the file /dtale/chart-data/1. The manipulation of the query argument leads to...

The vulnerability of the `systemSettingsDnsDataAction` method in the `/opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php` file exists in the DLP system of GTB Central Console. This vulnerability allows a malicious user to execute any command they desire.

The vulnerability of the systemSettingsDnsDataAction method in the /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php file is related to the lack of data cleansing at the management level in the GTB Central Console’s DLP system. Exploiting this vulnerability allows a maliciou...

Design/Logic Flaw

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

CVE-2024-0765 Default user role exporting save state of instance

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

CVE-2024-0765 Default user role exporting save state of instance

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

CVE-2023-49339

Ellucian Banner 9.17 allows Insecure Direct Object Reference IDOR via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint...

Ellucian Security Breach

Ellucian is Ellucian's open and flexible technology ecosystem supporting SaaS. A security vulnerability exists in Ellucian Banner version 9.17 and earlier, which stems from an insecure direct object reference IDOR vulnerability in the endpoint /StudentSelfService/ssb/studentCard/retrieveData...