1088 matches found
CVE-2025-62421 DataEase vulnerable to stored cross-site scripting via file upload bypass
DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/fileId that uses a URL path...
CVE-2025-62421
DataEase CVE-2025-62421 affects DataEase 2.10.13 and earlier. A stored Cross-Site Scripting vulnerability arises from improper file upload validation and authentication bypass, where the StaticResourceApi route upload/{fileId} allows user-controlled filename/extension. During permission checks, a...
EUVD-2025-34914
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...
CVE-2025-62422
DataEase (open source data visualization/analytics platform) contains a SQL injection vulnerability in the /de2api/datasetData/tableField interface for versions up to 2.10.13. An attacker can craft a malicious tableName parameter to execute arbitrary SQL commands. The issue is fixed in version 2....
CVE-2025-62422 DataEase SQL injection vulnerability
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...
CVE-2025-62422 DataEase SQL injection vulnerability
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...
CVE-2025-62422 DataEase SQL injection vulnerability
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...
PT-2025-42628
Name of the Vulnerable Software and Affected Versions DataEase versions through 2.10.13 Description DataEase is a data visualization and analytics platform. A stored cross-site scripting issue exists because of inadequate file upload validation and authentication bypass. The upload/fileId route...
PT-2025-42626
Name of the Vulnerable Software and Affected Versions DataEase versions through 2.10.13 Description DataEase is a data visualization and analytics platform. A JDBC URL injection vulnerability exists in the DB2 and MongoDB data sources. The issue allows for potential unauthorized access or...
DataEase code-related vulnerabilities
DataEase is a set of Java-based development of open source data visualization and analysis tools to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . A code injection vulnerability exists in DataEase DB2/MongoDB JDBC...
DataEase code-related vulnerabilities
DataEase is a set of Java-based development of open source data visualization and analysis tools to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . DataEase H2.java handles JDBC connection validation with a code injection...
DataEase cross-site scripting vulnerabilities
DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends to achieve business improvement and optimization. A cross-site scripting vulnerability exists in DataEase 2.10.13 and...
CVE-2025-62421: Improper Neutralization of Input During Web Page Generation
DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/fileId that uses a URL path...
CVE-2025-62422: Improper Neutralization of Special Elements used in an SQL Command
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...
CVE-2025-62420: Deserialization of Untrusted Data
DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vulnerability exists in the H2 database connection handler. The getJdbc function in H2.java checks if the jdbcUrl starts with jdbc:h2 but returns a separate jdbc field as the actual...
CVE-2025-62419: Deserialization of Untrusted Data
DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE...
DataEase SQL injection vulnerability
DataEase is a set of Java-based development of open source data visualization and analysis tools to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . DataEase /de2api/datasetData/tableField processing tableName parameter...
PT-2025-42629
Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.14 Description DataEase, a data visualization and analytics platform, has an issue where a malicious tableName parameter in the /de2api/datasetData/tableField API endpoint can lead to the execution of arbitrary...
PT-2025-42627
Name of the Vulnerable Software and Affected Versions DataEase versions through 2.10.13 Description DataEase is a data visualization and analytics platform. A JDBC driver bypass exists in the H2 database connection handler. The getJdbc function in H2.java checks if the jdbcUrl starts with jdbc:h2...