Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

dataease — Vulnerabilities & Security Advisories 89

All 89 CVE vulnerabilities found in dataease, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting DataEase, an open-source data analysis and business intelligence platform. It collects reported flaws across the software's version history, covering the period since the product's initial release through the most recent disclosed advisories. Readers can track the vendor's security posture, analyze specific weakness categories such as injection flaws or memory corruption issues, and review the complete vulnerability timeline for this product. The aggregation serves as a reference point for security teams managing DataEase deployments, allowing them to identify patterns in historical disclosures and assess the evolution of known risks without searching individual advisory databases.

Vendor: dataease

CVE ID Title CVSS Severity Published
CVE-2025-46566 Dataease redshift JDBC Connection Remote Code Execution CWE-923 8.8AI High AI 2025-05-01
CVE-2025-32966 Dataease H2 JDBC Connection Remote Code Execution CWE-290 8.8 - 2025-04-23
CVE-2025-27138 DataEase has an improper authentication vulnerability CWE-287 9.1 - 2025-03-13
CVE-2025-27103 Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability​ CWE-89 8.8 - 2025-03-13
CVE-2025-24974 DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability CWE-862 8.8 - 2025-03-13
CVE-2024-56511 DataEase has an unauthorized vulnerability CWE-289 9.1 - 2025-01-10
CVE-2024-55952 Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability CWE-20 8.8 - 2024-12-18
CVE-2024-55953 Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability CWE-89 8.8 - 2024-12-18
CVE-2024-52295 DataEase has a forged JWT token vulnerability CWE-798 9.8AI Critical AI 2024-11-13
CVE-2024-47073 Dataease arbitrary interface access vulnerability CWE-347 9.1AI Critical AI 2024-11-07
CVE-2024-47074 Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability CWE-502 9.8AI Critical AI 2024-10-11
CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk CWE-74 9.8 Critical 2024-09-23
CVE-2024-46985 DataEase has an XXE vulnerability CWE-611 7.5 High 2024-09-23
CVE-2024-31441 Arbitrary File Reading in DataEase CWE-863 7.5 High 2024-05-10
CVE-2024-30269 DataEase has database configuration information exposure vulnerability CWE-200 5.3 Medium 2024-04-08
CVE-2024-23328 The Dataease datasource exists deserialization and arbitrary file read vulnerability CWE-502 9.1 Critical 2024-02-01
CVE-2023-40183 DataEase has a vulnerability to obtain user cookies CWE-434 7.5 High 2023-09-21
CVE-2023-37258 DataEase has a SQL injection vulnerability that can bypass blacklists CWE-89 8.8 High 2023-07-25
CVE-2023-37257 The DataEase panel and dataset have a stored XSS vulnerability CWE-79 5.4 Medium 2023-07-25
CVE-2023-35164 Unauthorized users can manipulate a dashboard created by an administrator in DataEase CWE-862 6.3 Medium 2023-06-26
CVE-2023-34463 Unauthorized users can delete applications in DataEase CWE-862 8.1 High 2023-06-26
CVE-2023-35168 DataEase has a privilege bypass vulnerability CWE-732 6.5 Medium 2023-06-26
CVE-2023-33963 DataEase data source has deserialization vulnerability CWE-502 9.8 Critical 2023-06-01
CVE-2023-32310 DataEase API interface has IDOR vulnerability CWE-639 8.1 High 2023-06-01
CVE-2023-28637 DataEase AWS redshift data source exists for remote code execution vulnerability CWE-74 8.0 High 2023-03-28
CVE-2023-28437 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed CWE-89 9.8 Critical 2023-03-24
CVE-2023-28435 Dataease file upload interface does not verify permission or file type CWE-79 6.5 Medium 2023-03-24
CVE-2023-25807 DataEase dashboard has a stored XSS vulnerability CWE-79 7.2 High 2023-02-28
CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability CWE-20 9.8 Critical 2022-10-25

All 89 known CVE vulnerabilities affecting dataease with full Chinese analysis, references, and POCs where available.