All 7 CVE vulnerabilities found in SQLBot, with AI-generated Chinese analysis, references, and POCs.
Vendor: dataease
| CVE ID | Title | CVSS | Severity | Paused |
|---|---|---|---|---|
| CVE-2026-5417 | Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery CWE-918 | 4.7 | Medium | 2026-04-02 |
| CVE-2026-32950 | SQLBot: RCE via SQL Injection in Excel Upload Endpoint CWE-89 | 8.8 | - | 2026-03-20 |
| CVE-2026-32949 | SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL CWE-918 | 7.5 | - | 2026-03-20 |
| CVE-2026-32622 | SQLBot: Remote Code Execution via Terminology Poisoning CWE-862 | 8.8 | - | 2026-03-19 |
| CVE-2025-15598 | Dataease SQLBot JWT Token auth.py validateEmbedded signature verification CWE-347 | 3.7 | Low | 2026-03-03 |
| CVE-2025-15597 | Dataease SQLBot API Endpoint assistant.py access control CWE-284 | 6.3 | Medium | 2026-03-02 |
| CVE-2025-69285 | SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability CWE-306 | 9.8AI | CriticalAI | 2026-01-21 |
All 7 known CVE vulnerabilities affecting SQLBot with full Chinese analysis, references, and POCs where available.