Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

dataease — Vulnerabilities & Security Advisories 89

All 89 CVE vulnerabilities found in dataease, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting DataEase, an open-source data analysis and business intelligence platform. It collects reported flaws across the software's version history, covering the period since the product's initial release through the most recent disclosed advisories. Readers can track the vendor's security posture, analyze specific weakness categories such as injection flaws or memory corruption issues, and review the complete vulnerability timeline for this product. The aggregation serves as a reference point for security teams managing DataEase deployments, allowing them to identify patterns in historical disclosures and assess the evolution of known risks without searching individual advisory databases.

Vendor: dataease

CVE ID Title CVSS Severity Published
CVE-2023-40772 DataEase 路径遍历漏洞 CWE-23 4.3 Medium 2026-09-14
CVE-2026-90529 DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting CWE-79 3.5 Low 2026-09-13
CVE-2026-82879 DataEase before 2.10.26 Access Control Bypass via Share Tickets CWE-863 6.3 Medium 2026-08-31
CVE-2026-82878 DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints CWE-862 6.3 Medium 2026-08-31
CVE-2026-45532 DataEase has a Path Traversal Vulnerability CWE-22 8.7 High 2026-08-18
CVE-2026-49867 DataEase: Authenticated Stored XSS in DataEase Template Static Resources CWE-79 - - 2026-07-15
CVE-2026-46684 DataEase: Unauthorized Command Execution Vulnerability CWE-347 - - 2026-07-15
CVE-2026-45320 DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection CWE-89 - - 2026-07-15
CVE-2026-45535 DataEase: Stored SQL Injection Vulnerability CWE-89 - - 2026-07-15
CVE-2026-45533 DataEase: Path Traversal Vulnerability CWE-22 - - 2026-07-15
CVE-2026-50124 DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper CWE-434 - - 2026-07-15
CVE-2026-50030 DataEase: Arbitrary SQL execution in preview path (direct data disclosure) CWE-89 - - 2026-07-15
CVE-2026-45419 DataEase: Arbitrary File Write Vulnerability CWE-22 - - 2026-07-15
CVE-2026-45417 DataEase: SQL injection vulnerability CWE-89 - - 2026-07-15
CVE-2026-45534 DataEase: RCE Vulnerability CWE-94 - - 2026-07-15
CVE-2026-50530 DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets CWE-639 - - 2026-07-07
CVE-2026-50529 DataEase: Link Token Leakage Prior to Share Password/Ticket Validation CWE-863 - - 2026-07-07
CVE-2026-55647 DataEase: authenticated stored XSS in the dashboard text components CWE-79 - - 2026-07-07
CVE-2026-55635 DataEase: Authenticated SQL Injection in Chart Quota Filters CWE-89 - - 2026-07-07
CVE-2026-57172 DataEase: Hardcoded JWT Signing Secret in ShareLink CWE-321 - - 2026-07-07
CVE-2026-53751 DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE) CWE-94 - - 2026-07-07
CVE-2026-53730 DataEase: Unauthorized Access to Engine Database via previewSql Endpoint CWE-862 - - 2026-07-07
CVE-2026-55633 DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass CWE-434 - - 2026-07-07
CVE-2026-55631 DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management CWE-22 - - 2026-07-07
CVE-2026-53729 DataEase ExportCenter IDOR allows cross-user export task access CWE-639 - - 2026-07-07
CVE-2026-8724 Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection CWE-89 4.7 Medium 2026-05-17
CVE-2026-40901 DataEase: Quartz Deserialization → Remote Code Execution CWE-502 8.8AI High AI 2026-04-16
CVE-2026-40900 DataEase has SQL Injection via Stacked Queries CWE-89 8.8AI High AI 2026-04-16
CVE-2026-40899 DataEase has an Arbitrary File Read Vulnerability CWE-183 8.3AI High AI 2026-04-16
CVE-2026-33207 DataEase SQL Injection Vulnerability CWE-89 9.8AI Critical AI 2026-04-16

All 89 known CVE vulnerabilities affecting dataease with full Chinese analysis, references, and POCs where available.