CVE-2026-50137: Missing Authorization

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

CVE-2026-45717: Missing Authorization

Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourceId is registered in the authorizedRoutes group with TABLE/READ permission. This is the same authorization level as the read endpoint GET...

EUVD-2022-6421

Malicious code in bioql PyPI...

CVE-2022-34115

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId...

Dataease v1.11.1 SQL Injection via parameter dataSourceId

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. Version 1.11.2 contains a fix...

SQL Injection found in Dataease

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. Version 1.11.2 contains a fix...

CVE-2022-34114

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId...

CVE-2022-34114

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId...

CVE-2022-34115

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId...

CVE-2022-34115

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId...

CVE-2022-34114

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId...

CVE-2022-34114

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId...

CVE-2022-34115

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId...

CVE-2022-34115

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId...

CVE-2022-34115

DataEase v1.11.1 is affected by a SQL injection vulnerability via the dataSourceId parameter. The issue is tracked as CVE-2022-34115; it is reported as critical (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A fix is available in v1.11.2. The connected sources also reference advisories and...

PT-2022-22012

Name of the Vulnerable Software and Affected Versions Dataease versions 1.11.1 Description The issue is a SQL injection vulnerability that can be exploited via the dataSourceId parameter. This allows an attacker to inject malicious SQL code, potentially leading to unauthorized access or...

CVE-2022-34114: Improper Neutralization of Special Elements used in an SQL Command

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId...

CVE-2022-34115: Unrestricted Upload of File with Dangerous Type

DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId...