CVE-2026-104143

Prior to version 2.10.26 , the DataEase data visualization tool is vulnerable to a Stored SQL Injection . Authenticated users can provide a crafted dateFormat for a dataset field, which is inserted without validation into date conversion templates (including Dimension2SQLObj and Field2SQLObj). In...