Vulnerabilidades em dataease
108 resultadosAnálise Vexday
O DataEase acumula 69 CVEs catalogadas, das quais 12 são de severidade crítica e 11 surgiram nos últimos 90 dias, indicando um ritmo relevante de descoberta recente. O tipo de falha mais comum é CWE-89 (injeção de SQL), o que aponta para fragilidades estruturais na camada de acesso a dados que tendem a ter alto impacto quando exploradas. A CVE mais perigosa ativa no momento é CVE-2025-49002, com EPSS de 0,4184, sugerindo probabilidade não trivial de exploração em curto prazo, apesar de nenhuma CVE constar no catálogo KEV da CISA — taxa abaixo da média geral do catálogo. A existência de PoC pública para ao menos uma vulnerabilidade reforça a necessidade de atenção contínua ao ciclo de atualização deste produto.
CVE-2026-49867MEDIUMDataEase: Authenticated Stored XSS in DataEase Template Static ResourcesEPSS 0.5%CVE-2026-50030HIGHDataEase: Arbitrary SQL execution in preview path (direct data disclosure)EPSS 0.5%CVE-2026-55647MEDIUMDataEase: authenticated stored XSS in the dashboard text componentsEPSS 0.5%CVE-2026-45320HIGHDataEase Data Dashboard SqlVariable transFilter Unfiltered SQL InjectionEPSS 0.5%CVE-2023-28435MEDIUMDataease file upload interface does not verify permission or file typeEPSS 0.5%CVE-2026-45419HIGHDataEase: Arbitrary File Write VulnerabilityEPSS 0.5%CVE-2026-45533HIGHDataEase: Path Traversal VulnerabilityEPSS 0.5%CVE-2026-55631HIGHDataEase: Path Traversal Leading to Arbitrary File Deletion via Font ManagementEPSS 0.5%CVE-2025-27103HIGHDataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read VulnerabilityEPSS 0.5%CVE-2025-69285HIGHSQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-32949HIGHSQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQLEPSS 0.5%CVE-2026-57172HIGHDataEase: Hardcoded JWT Signing Secret in ShareLinkEPSS 0.4%CVE-2023-35164MEDIUMUnauthorized users can manipulate a dashboard created by an administrator in DataEaseEPSS 0.4%CVE-2026-121453MEDIUMSQLBot through 1.10.3 Path Traversal via datasource importToDb EndpointEPSS 0.4%CVE-2026-32137CRITICALDataEase SQL Injection VulnerabilityEPSS 0.4%CVE-2023-37257MEDIUMThe DataEase panel and dataset have a stored XSS vulnerabilityEPSS 0.4%CVE-2025-62419HIGHDataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configurationEPSS 0.4%CVE-2026-93660HIGHSQLBot through 1.10.1 Improper Access Control via Dashboard UpdateEPSS 0.4%CVE-2026-53554HIGHSQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import ProcessingEPSS 0.4%CVE-2026-50530HIGHDataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared DatasetsEPSS 0.4%