Datart v1.0.0-rc.3 - Remote Code Execution

Datart v1.0.0-rc.3 contains a vulnerability that allows remote attackers to execute arbitrary code via INIT connection parameters. id: CVE-2025-56819 info: name: Datart v1.0.0-rc.3 - Remote Code Execution author: Redmomn severity: critical description: | Datart v1.0.0-rc.3 contains a vulnerabilit...

CVE-2025-56815

CVE-2025-56815 Datart 1.0.0-rc.3 уязвим к обходу каталога в интерфейсе POST /viz/image, так как сервер напрямую использует MultipartFile.transferTo для сохранения загруженного файла в путь, контролируемый пользователем, и не выполняет строгую проверку имени файла. POST...

CVE-2025-70830

CVE-2025-70830: Datart Server-Side Template Injection SSTI 취약점 개요 Overview CVE 번호 : CVE-2025-70830 영향받는 제품 : Datart 영향받는 버전 : v1.0.0-rc.3 취약점 유형 : Server-Side Template Injection SSTI - 서버 측 템플릿 인젝션 위험 등급 : Remote Code Execution RCE 취약점 설명 Description Datart v1.0.0-rc.3 버전의 Freemarker 템플릿 엔진에 서버 측...

CVE-2025-70828

CVE-2025-70828 Résumé Une vulnérabilité de lecture arbitraire de fichier a été découverte dans Datart v1.0.0-rc.3. L'application ne parvient pas à valider correctement l'URL de connexion JDBC lors de la configuration de la source de données. Détails de la vulnérabilité Type de vulnérabilité :...

CVE-2025-70829

CVE-2025-70829: Раскрытие информации в Datart 中文文档 1. Обзор уязвимости CVE ID : CVE-2025-70829 Продукт : Datart Версия : v1.0.0-rc.3 Тип уязвимости : Раскрытие информации Уязвимость раскрытия информации в Datart v1.0.0-rc.3 позволяет аутентифицированным злоумышленникам получить доступ к...

CVE-2025-56819

CVE-2025-56819 Un problème dans Datart v.1.0.0-rc.3 permet à un attaquant distant d'exécuter du code arbitraire via le paramètre de connexion INIT. POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type":...

CVE-2025-70830

A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...

CVE-2025-70829

An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...

CVE-2025-70828

An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...

CVE-2025-70828

An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...

CVE-2025-70830

A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...

CVE-2025-70830

A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...

CVE-2025-70829

An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...

CVE-2025-70829

An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...

CVE-2025-70830

The open-source data visualization platform Datart v1.0.0-rc.3 contains a Server-Side Template Injection (SSTI) vulnerability within its Freemarker template engine . The root cause is the improper cleaning of inputs provided to the SQL script field . This allows authenticated attackers to inject ...

CVE-2025-70830

A Server-Side Template Injection SSTI vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script field...

CVE-2025-70829: Exposure of Sensitive Information to an Unauthorized Actor

An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...

CVE-2025-70828

An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...

CVE-2025-70828

An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...

CVE-2025-70828: Improper Neutralization of Special Elements used in an OS Command

An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration...