PT-2026-95138

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-38158

The ureport reporting engine, specifically version 2.2.9 (package com.bstek.ureport:ureport2-console ), contains a SQL injection vulnerability in the /ureport/datasource/previewData component. The root cause is the insufficient validation of SQL statements and the use of unsafely constructed SQL ...

CVE-2026-38158

A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-32137: Improper Neutralization of Special Elements used in an SQL Command

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject...