95 matches found
CVE-2024-37759_PoC
CVE-2024-37759 PoC Descripción DataGear versión 5.0.0 y anteriores tiene una vulnerabilidad de inyección de expresiones SpEL que conduce a la ejecución remota de código. Exploit Detalles del Exploit CVE Cuando solicita la interfaz /data/schemaId/tableName/view, si la tabla de la base de datos no...
CVE-2026-92566
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566 DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566
DataGear through 6.0.0 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /dataSet/preview/Http endpoint. By supplying a caller-controlled URI, an attacker can issue GET, POST, PUT, PATCH, or DELETE requests to internal services and cloud metadata endpoints, recei...
EUVD-2026-80812
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566 DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566 DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-92566: Server-Side Request Forgery (SSRF)
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to interna...
CVE-2026-19110
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...
CVE-2026-19110 DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...
CVE-2026-19110: Improper Neutralization of Input During Web Page Generation
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
EUVD-2025-202461
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...
PT-2025-50349
Name of the Vulnerable Software and Affected Versions DataGear version 5.5.0 Description DataGear version 5.5.0 is susceptible to Arbitrary File Deletion. The issue allows for the deletion of arbitrary files. Recommendations At the moment, there is no information about a newer version that contai...
CVE-2025-65792
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion , a flaw categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). This vulnerability allows an attacker to delete arbitrary files on the system. The impact is rated as CRITICAL with a CVSS 3.1 score of 9.1 , s...
DataGear 安全漏洞
DataGear is an open source, free data visualization and analysis platform from DataGear, Inc. A security vulnerability exists in DataGear version 5.5.0, which originates from the possibility of arbitrary file deletion...