Advisories · Technology

dataease.

Every CVE that names dataease among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-53004 CVE record

CVSS 8.9 High

Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
- dataease
- CWE-153
Not analysed yet 30 Jun 2025
CVE-2025-49003 CVE record

CVSS 8.9 High

Dataease H2 JDBC Connection Remote Code Execution
- dataease
- CWE-153
Not analysed yet 26 Jun 2025
CVE-2025-49002 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
- dataease
- Authentication bypass
Not analysed yet 3 Jun 2025
CVE-2025-49001 CVE record

CVSS 7.7 HighCritical · CVSS 7+ and EPSS

Dataease Authentication Bypass Vulnerability
- dataease
- Authentication bypass
Not analysed yet 3 Jun 2025
CVE-2025-48999 CVE record

CVSS 6.8 Medium

Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
- dataease
- Broken access control
- CWE-923
Not analysed yet 3 Jun 2025
CVE-2025-48998 CVE record

CVSS 7.3 High

Dataease MYSQL JDBC File Reading Vulnerability
- dataease
- SQL injection
- Broken access control
Not analysed yet 3 Jun 2025
CVE-2025-46566 CVE record

CVSS 6.8 Medium

Dataease redshift JDBC Connection Remote Code Execution
- dataease
- Broken access control
- CWE-923
Not analysed yet 1 May 2025
CVE-2025-32966 CVE record

CVSS 8.2 High

Dataease H2 JDBC Connection Remote Code Execution
- dataease
- Authentication bypass
Not analysed yet 23 Apr 2025
CVE-2025-27138 CVE record

CVSS 7.7 High

DataEase has an improper authentication vulnerability
- dataease
- Authentication bypass
Not analysed yet 13 Mar 2025
CVE-2025-27103 CVE record

CVSS 7.3 High

Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability
- dataease
- SQL injection
- Broken access control
Not analysed yet 13 Mar 2025
CVE-2025-24974 CVE record

CVSS 7.3 High

DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability
- dataease
- SQL injection
- Broken access control
Not analysed yet 13 Mar 2025
CVE-2024-56511 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

DataEase has an unauthorized vulnerability
- dataease
- CWE-289
Not analysed yet 10 Jan 2025
CVE-2024-55952 CVE record

CVSS 8.6 High

Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
- dataease
- CWE-20
Not analysed yet 18 Dec 2024
CVE-2024-55953 CVE record

CVSS 8.6 High

Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
- dataease
- SQL injection
Not analysed yet 18 Dec 2024
CVE-2024-52295 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

DataEase has a forged JWT token vulnerability
- dataease
- Hard-coded credentials
Not analysed yet 13 Nov 2024
CVE-2024-47073 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Dataease arbitrary interface access vulnerability
- dataease
- Weak cryptography or TLS
Not analysed yet 7 Nov 2024
CVE-2024-47074 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
- dataease
- Insecure deserialization
Not analysed yet 11 Oct 2024
CVE-2024-31441 CVE record

CVSS 7.5 High

Arbitrary File Reading in DataEase
- dataease
- Broken access control
Not analysed yet 10 May 2024
CVE-2024-30269 CVE record

CVSS 5.3 Medium

DataEase has database configuration information exposure vulnerability
- dataease
- Information disclosure
Not analysed yet 8 Apr 2024
CVE-2024-23328 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

The Dataease datasource exists deserialization and arbitrary file read vulnerability
- dataease
- Insecure deserialization
Not analysed yet 1 Feb 2024
CVE-2023-40183 CVE record

CVSS 7.5 High

DataEase has a vulnerability to obtain user cookies
- dataease
- Unrestricted file upload
Not analysed yet 21 Sept 2023
CVE-2023-37258 CVE record

CVSS 8.8 High

DataEase has a SQL injection vulnerability that can bypass blacklists
- dataease
- SQL injection
Not analysed yet 25 Jul 2023
CVE-2023-37257 CVE record

CVSS 5.4 Medium

The DataEase panel and dataset have a stored XSS vulnerability
- dataease
- Cross-site scripting (XSS)
Not analysed yet 25 Jul 2023
CVE-2023-35164 CVE record

CVSS 6.3 Medium

Unauthorized users can manipulate a dashboard created by an administrator in DataEase
- dataease
- Broken access control
Not analysed yet 26 Jun 2023
CVE-2023-34463 CVE record

CVSS 8.1 High

Unauthorized users can delete applications in DataEase
- dataease
- Broken access control
Not analysed yet 26 Jun 2023
CVE-2023-35168 CVE record

CVSS 6.5 Medium

DataEase has a privilege bypass vulnerability
- dataease
- Broken access control
Not analysed yet 26 Jun 2023
CVE-2023-33963 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

DataEase data source has deserialization vulnerability
- dataease
- Insecure deserialization
Not analysed yet 1 Jun 2023
CVE-2023-28637 CVE record

CVSS 8.0 High

DataEase AWS redshift data source exists for remote code execution vulnerability
- dataease
- Other injection
Not analysed yet 28 Mar 2023
CVE-2023-28437 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
- dataease
- SQL injection
Not analysed yet 24 Mar 2023
CVE-2023-28435 CVE record

CVSS 6.5 Medium

Dataease file upload interface does not verify permission or file type
- dataease
- Cross-site scripting (XSS)
Not analysed yet 24 Mar 2023
CVE-2023-25807 CVE record

CVSS 7.2 High

DataEase dashboard has a stored XSS vulnerability
- dataease
- Cross-site scripting (XSS)
Not analysed yet 28 Feb 2023