Vulnerabilidades en dataease
102 resultadosAnálisis Vexday
O DataEase acumula 69 CVEs catalogadas, das quais 12 são de severidade crítica e 11 surgiram nos últimos 90 dias, indicando um ritmo relevante de descoberta recente. O tipo de falha mais comum é CWE-89 (injeção de SQL), o que aponta para fragilidades estruturais na camada de acesso a dados que tendem a ter alto impacto quando exploradas. A CVE mais perigosa ativa no momento é CVE-2025-49002, com EPSS de 0,4184, sugerindo probabilidade não trivial de exploração em curto prazo, apesar de nenhuma CVE constar no catálogo KEV da CISA — taxa abaixo da média geral do catálogo. A existência de PoC pública para ao menos uma vulnerabilidade reforça a necessidade de atenção contínua ao ciclo de atualização deste produto.
CVE-2025-53006HIGHDataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass VulnerabilityEPSS 0.6%CVE-2024-47074CRITICALDataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization VulnerabilityEPSS 0.6%CVE-2025-64164HIGHDataEase is vulnerable to Oracle JNDI InjectionEPSS 0.6%CVE-2025-53005HIGHDataease PostgreSQL Data Source JDBC Connection Parameters Bypass VulnerabilityEPSS 0.6%CVE-2025-53004HIGHDataease Redshift Data Source JDBC Connection Parameters Bypass VulnerabilityEPSS 0.6%CVE-2025-64428HIGHDataEase DB2 JNDI VulnerabilityEPSS 0.6%CVE-2025-27138HIGHDataEase has an improper authentication vulnerabilityEPSS 0.6%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.6%CVE-2026-50124HIGHDataEase: Remote Code Execution (RCE) via Zip Protocol & File DropperEPSS 0.6%CVE-2024-31441HIGHArbitrary File Reading in DataEaseEPSS 0.6%CVE-2025-15597MEDIUMDataease SQLBot API Endpoint assistant.py access controlEPSS 0.5%CVE-2026-23958HIGHDataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account TakeoverEPSS 0.5%CVE-2023-25807HIGHDataEase dashboard has a stored XSS vulnerabilityEPSS 0.5%CVE-2025-62422HIGHDataEase SQL injection vulnerabilityEPSS 0.5%CVE-2025-48998HIGHDataease MYSQL JDBC File Reading VulnerabilityEPSS 0.5%CVE-2026-50529HIGHDataEase: Link Token Leakage Prior to Share Password/Ticket ValidationEPSS 0.5%CVE-2026-45532HIGHDataEase has a Path Traversal VulnerabilityEPSS 0.5%CVE-2026-45320HIGHDataEase Data Dashboard SqlVariable transFilter Unfiltered SQL InjectionEPSS 0.5%CVE-2026-50030HIGHDataEase: Arbitrary SQL execution in preview path (direct data disclosure)EPSS 0.5%CVE-2026-49867MEDIUMDataEase: Authenticated Stored XSS in DataEase Template Static ResourcesEPSS 0.5%