Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

dataease — Vulnerabilities & Security Advisories 84

All 84 CVE vulnerabilities found in dataease, with AI-generated Chinese analysis, references, and POCs.

This page documents Common Weakness Enumerations affecting DataEase, an open-source data visualization and dashboard tool developed by Wuhan Yuxin Technology. It aggregates security vulnerabilities ranging from cross-site scripting and injection flaws to privilege escalation and server-side request forgery, covering incidents reported between 2023 and 2024. By organizing these entries by severity and component, the resource allows security professionals to track the vendor's historical advisory timeline, understand the prevalence of specific weakness classes within this particular software stack, and look up the detailed vulnerability history of individual product versions. The collected data includes technical descriptions, affected versions, and known remediation strategies, providing a centralized view of the product's security posture over time. This aggregation serves as a reference for developers and system administrators conducting risk assessments or planning patch management cycles. It highlights recurring issues that may indicate deeper architectural weaknesses versus isolated implementation errors. Users can compare the frequency of different vulnerability types to prioritize defense mechanisms or evaluate the impact of recent releases on overall system stability. The information is compiled from publicly available security advisories, third-party scanners, and community reports to ensure comprehensive coverage without relying on proprietary internal data. This approach offers an objective basis for understanding the threat landscape surrounding DataEase deployments.

Vendor: dataease

CVE IDTitleCVSSSeverityPublished
CVE-2026-49867 DataEase: Authenticated Stored XSS in DataEase Template Static Resources CWE-79--2026-07-15
CVE-2026-46684 DataEase: Unauthorized Command Execution Vulnerability CWE-347--2026-07-15
CVE-2026-45320 DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection CWE-89--2026-07-15
CVE-2026-45535 DataEase: Stored SQL Injection Vulnerability CWE-89--2026-07-15
CVE-2026-45533 DataEase: Path Traversal Vulnerability CWE-22--2026-07-15
CVE-2026-50124 DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper CWE-434--2026-07-15
CVE-2026-50030 DataEase: Arbitrary SQL execution in preview path (direct data disclosure) CWE-89--2026-07-15
CVE-2026-45419 DataEase: Arbitrary File Write Vulnerability CWE-22--2026-07-15
CVE-2026-45417 DataEase: SQL injection vulnerability CWE-89--2026-07-15
CVE-2026-45534 DataEase: RCE Vulnerability CWE-94--2026-07-15
CVE-2026-50530 DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets CWE-639--2026-07-07
CVE-2026-50529 DataEase: Link Token Leakage Prior to Share Password/Ticket Validation CWE-863--2026-07-07
CVE-2026-55647 DataEase: authenticated stored XSS in the dashboard text components CWE-79--2026-07-07
CVE-2026-55635 DataEase: Authenticated SQL Injection in Chart Quota Filters CWE-89--2026-07-07
CVE-2026-57172 DataEase: Hardcoded JWT Signing Secret in ShareLink CWE-321--2026-07-07
CVE-2026-53751 DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE) CWE-94--2026-07-07
CVE-2026-53730 DataEase: Unauthorized Access to Engine Database via previewSql Endpoint CWE-862--2026-07-07
CVE-2026-55633 DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass CWE-434--2026-07-07
CVE-2026-55631 DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management CWE-22--2026-07-07
CVE-2026-53729 DataEase ExportCenter IDOR allows cross-user export task access CWE-639--2026-07-07
CVE-2026-8724 Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection CWE-89 4.7 Medium2026-05-17
CVE-2026-40901 DataEase: Quartz Deserialization → Remote Code Execution CWE-502 8.8AIHighAI2026-04-16
CVE-2026-40900 DataEase has SQL Injection via Stacked Queries CWE-89 8.8AIHighAI2026-04-16
CVE-2026-40899 DataEase has an Arbitrary File Read Vulnerability CWE-183 8.3AIHighAI2026-04-16
CVE-2026-33207 DataEase SQL Injection Vulnerability CWE-89 9.8AICriticalAI2026-04-16
CVE-2026-33122 DataEase has SQL Injection via Datasource Management CWE-89 8.8AIHighAI2026-04-16
CVE-2026-33121 DataEase has SQL Injection via Datasource Save Flow CWE-89 8.1AIHighAI2026-04-16
CVE-2026-33084 DataEase has SQL Injection through its getFieldEnumObj Endpoint CWE-89 7.5AIHighAI2026-04-16
CVE-2026-33083 DataEase has SQL Injection in Order By Clause CWE-89 8.8AIHighAI2026-04-16
CVE-2026-33082 DataEase: SQL Injection in v2 Dataset Export CWE-89 9.8AICriticalAI2026-04-16

All 84 known CVE vulnerabilities affecting dataease with full Chinese analysis, references, and POCs where available.