Advisories · Technology
dataease SQLBot.
Every CVE that names dataease SQLBot among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
- dataease SQLBot
- Path traversal
- CVSS 7.1 High
SQLBot through 1.10.1 Improper Access Control via Dashboard Update
- dataease SQLBot
- Broken access control
- CVSS 7.7 High
SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
- dataease SQLBot
- SQL injection
- CVSS 5.1 Medium
Stored XSS via SVG Upload
- dataease SQLBot
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read
- dataease SQLBot
- SQL injection
- CVSS 7.3 High
SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing
- dataease SQLBot
- Path traversal
- CVSS 5.1 Medium
SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
- dataease SQLBot
- Cross-site scripting (XSS)
- CVSS 8.6 High
SQLBot: Unauthorized Access Vulnerability
- dataease SQLBot
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
SQLBot prompt injection allows arbitrary SQL execution and remote code execution
- dataease SQLBot
- SQL injection
- CVSS 5.1 Medium
Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
- Dataease SQLbot
- Server-side request forgery (SSRF)
- CVSS 8.6 High
SQLBot: RCE via SQL Injection in Excel Upload Endpoint
- dataease SQLBot
- Command injection
- SQL injection
- CVSS 8.7 High
SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL
- dataease SQLBot
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 8.6 High
SQLBot: Remote Code Execution via Terminology Poisoning
- dataease SQLBot
- Other injection
- Command injection
- CVSS 6.3 Medium
Dataease SQLBot JWT Token auth.py validateEmbedded signature verification
- Dataease SQLBot
- Weak cryptography or TLS
- CWE-345
- CVSS 5.3 Medium
Dataease SQLBot API Endpoint assistant.py access control
- Dataease SQLBot
- Privilege escalation
- Broken access control
- CVSS 7.7 High
SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability
- dataease SQLBot
- Authentication bypass