EXPLOIT-CVE-2026-40901

DataEase — تنفيذ أوامر عن بُعد دون مصادقة عبر سلسلة من 4 ثغرات CVE-2026-40901 وأخواتها تجاوز المصادقة → تجاوز قائمة حظر JDBC قراءة ملفات عشوائية → حقن SQL → إلغاء تسلسل Java في Quartz → تنفيذ أوامر عن بُعد بصلاحياتroot. مختبر محلي متكامل Docker + PoC عملي. تم الإصلاح في DataEase v2.10.21. DataEas...

CVE-2026-40899 DataEase has an Arbitrary File Read Vulnerability

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

CVE-2026-40899

DataEase

CVE-2026-40899 DataEase has an Arbitrary File Read Vulnerability

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

CVE-2026-40899: Permissive List of Allowed Inputs

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...