EUVD-2026-120544

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...

CVE-2026-125381

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...

CVE-2026-125381: gcpaas DataRoom: DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role…

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...

CVE-2026-125381 DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...

CVE-2026-125381

DataRoom versions up to and including 3.0.0 are vulnerable to an SQL injection in the MyBatisService.generateSql component. This flaw allows users with the sharer-role to execute arbitrary SQL commands against the database by providing crafted dataset parameters via the /dataRoom/dataset/run endp...

CVE-2026-125381 DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...

PT-2026-141204

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL...