CVE-2026-32137
DataEase SQL Injection Vulnerability
Résumé
DataEase SQL Injection Vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov