CVE-2026-45417highCWE-89

CVE-2026-45417: fallo de gravedad alta en dataease

DataEase: SQL injection vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear dataease

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.4%
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
dataease · dataease
CVEs relacionadas — dataease

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-49002HIGHDataease H2 Database Remote Code Execution (RCE) Bypass VulnerabilityEPSS 50.4%CVE-2024-56511CRITICALDataEase has an unauthorized vulnerabilityEPSS 50.3%CVE-2025-49001HIGHDataease Authentication Bypass VulnerabilityEPSS 22.0%CVE-2024-30269MEDIUMDataEase has database configuration information exposure vulnerabilityEPSS 15.9%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 10.9%CVE-2025-48999MEDIUMDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 10.4%