CVE Browser

SQLBot through 1.10.1 Improper Access Control via Dashboard Update

SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

Stored XSS via SVG Upload

SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticRe…

DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting

DataEase before 2.10.26 Access Control Bypass via Share Tickets

DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints

DataEase has a Path Traversal Vulnerability

SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

DataEase: Authenticated Stored XSS in DataEase Template Static Resources

DataEase: Unauthorized Command Execution Vulnerability

DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection

DataEase: Stored SQL Injection Vulnerability

DataEase: Path Traversal Vulnerability

DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper

DataEase: Arbitrary SQL execution in preview path (direct data disclosure)

DataEase: Arbitrary File Write Vulnerability

DataEase: SQL injection vulnerability

DataEase: RCE Vulnerability

DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets

DataEase: Link Token Leakage Prior to Share Password/Ticket Validation

DataEase: authenticated stored XSS in the dashboard text components

DataEase: Authenticated SQL Injection in Chart Quota Filters