103 matches found
CVE-2024-37759_PoC
CVE-2024-37759 PoC Description DataGear version 5.0.0 and earlier has a SpEL expression injection vulnerability that leads to remote code execution. Exploit CVE Exploit Details When you request the /data/schemaId/tableName/view interface, if the database table does not have a primary key, an...
CVE-2026-92566
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566 DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566
DataGear through 6.0.0 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /dataSet/preview/Http endpoint. By supplying a caller-controlled URI, an attacker can issue GET, POST, PUT, PATCH, or DELETE requests to internal services and cloud metadata endpoints, recei...
CVE-2026-92566 DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
EUVD-2026-80812
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566 DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566: Server-Side Request Forgery (SSRF)
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
PT-2026-93811
Name of the Vulnerable Software and Affected Versions DataGear versions prior to 6.0.1 Description An issue exists where unauthenticated attackers can execute arbitrary HTTP requests by providing a caller-controlled URI. This occurs via the '/dataSet/preview/Http' endpoint, allowing the issuance ...
CVE-2026-19110
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...
CVE-2026-19110 DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...
PT-2026-68679
Name of the Vulnerable Software and Affected Versions DataGear versions prior to 5.0.0 Description Cross site scripting occurs in the Chart Name Handler component due to improper handling of the Title argument within the HtmlTplDashboardWidgetHtmlRenderer function of the...
CVE-2026-19110: Improper Neutralization of Input During Web Page Generation
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
EUVD-2025-202461
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion , a flaw categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). This vulnerability allows an attacker to delete arbitrary files on the system. The impact is rated as CRITICAL with a CVSS 3.1 score of 9.1 , s...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
PT-2025-50349
Name of the Vulnerable Software and Affected Versions DataGear version 5.5.0 Description DataGear version 5.5.0 is susceptible to Arbitrary File Deletion. The issue allows for the deletion of arbitrary files. Recommendations At the moment, there is no information about a newer version that contai...