70 matches found
Datart v1.0.0-rc.3 - Remote Code Execution
Datart v1.0.0-rc.3 contains a vulnerability that allows remote attackers to execute arbitrary code via INIT connection parameters. id: CVE-2025-56819 info: name: Datart v1.0.0-rc.3 - Remote Code Execution author: Redmomn severity: critical description: | Datart v1.0.0-rc.3 contains a vulnerabilit...
CVE-2025-56815
CVE-2025-56815 Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo to save the uploaded file to a path controllable by the user, and lacks strict verification of the filename. root@kitploit: POST...
CVE-2025-70830
CVE-2025-70830: Datart Server-Side Template Injection SSTI Vulnerability Overview Overview CVE ID : CVE-2025-70830 Affected Product : Datart Affected Version : v1.0.0-rc.3 Vulnerability Type : Server-Side Template Injection SSTI - Server-Side Template Injection Risk Level : Remote Code Execution...
CVE-2025-70828
CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...
CVE-2025-70829
CVE-2025-70829: Information Exposure in Datart 中文文档 1. Vulnerability Overview CVE ID : CVE-2025-70829 Product : Datart Version : v1.0.0-rc.3 Vulnerability Type : Information Exposure An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive dat...
CVE-2025-56819
CVE-2025-56819 An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. root@kitploit: POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type":...
CVE-2025-70830
A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...
CVE-2025-70829
An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...
CVE-2025-70828
An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...
CVE-2025-70830
A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...
CVE-2025-70828
An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...
CVE-2025-70830
A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...
CVE-2025-70829
An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...
CVE-2025-70829
An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...
CVE-2025-70830
A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...
CVE-2025-70828
An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...
datart 安全漏洞
Datart is an open-source data visualization platform developed by running-elephant. Version datart v1.0.0-rc.3 contains a security vulnerability. This vulnerability stems from allowing authenticated attackers to access sensitive data through custom H2 JDBC connection strings, resulting in...
CVE-2025-70830
CVE-2025-70830 describes a Server-Side Template Injection (SSTI) in the Freemarker template engine of Datart v1.0.0-rc.3. An authenticated attacker can inject crafted Freemarker template syntax into the SQL script field to achieve arbitrary code execution. Affected software: Datart (Freemarker te...
CVE-2025-70828
Datart v1.0.0-rc.3 contains a vulnerability where the JDBC configuration’s url parameter allows attackers to execute arbitrary code. The issue is consistently described across Red Hat, CVE listings, and PT Security, identifying the affected component as the JDBC URL handling. Impact is described ...
