目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1336 CNY

100%

chartbrew 厂商漏洞列表 / CVE 中文分析 15

chartbrew 厂商相关 15 条 CVE 漏洞,含 AI 中文分析、POC、CVSS 评分与受影响产品。

Chartbrew 是一个开源数据可视化工具,主要用于将各种数据源转换为交互式图表和仪表板。历史上,该平台曾存在多处安全漏洞,包括远程代码执行、跨站脚本攻击和权限绕过等问题,这些漏洞可能导致未授权访问或系统被控制。截至最新统计,已记录 14 条 CVE 漏洞,主要集中在身份验证和数据处理环节。用户需及时更新版本并实施最小权限原则以降低风险。

15 件の結果 / 15フィルターをクリア
上位製品 chartbrew: chartbrew
CVE IDタイトルCVSS深刻度公開日
CVE-2026-41518 Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) — chartbrewCWE-79 7.6 High2026-06-04
CVE-2026-40603 Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override — chartbrewCWE-284 6.5 Medium2026-04-30
CVE-2026-40601 Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle — chartbrewCWE-862 7.5 High2026-04-30
CVE-2026-40600 Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id — chartbrewCWE-639 8.1 High2026-04-30
CVE-2026-40595 Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks — chartbrewCWE-284 7.5 High2026-04-30
CVE-2026-35514 Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew — chartbrewCWE-306 6.5 Medium2026-04-30
CVE-2026-40904 Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks — chartbrewCWE-284 8.1 High2026-04-30
CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` — chartbrewCWE-285 7.7 High2026-04-10
CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs — chartbrewCWE-918 8.1 -2026-04-10
CVE-2026-27605 Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API — chartbrewCWE-434 6.3 Medium2026-03-06
CVE-2026-27603 Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions — chartbrewCWE-306 5.3 -2026-03-06
CVE-2026-27005 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) — chartbrewCWE-89 9.1 -2026-03-06
CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API — chartbrewCWE-94 8.8 High2026-03-06
CVE-2026-25887 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query — chartbrewCWE-94 7.2 High2026-03-06
CVE-2026-25877 Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations — chartbrewCWE-284 6.5 Medium2026-03-06

本页汇总了 chartbrew 厂商截至目前公开的全部 15 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接,并附带 AI 生成的中文分析以便快速判断风险。