DataEase vulnerabilities
We track 84 vulnerabilities in DataEase products across 2 products. 84 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest DataEase vulnerabilities
- 8.1 High severity
dataease: Authorization Bypass Through User-Controlled Key
DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard
- 8.8 High severity
dataease: Improper Neutralization of Special Elements in Output Used by a Downstream Component
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to re
- 9.8 Critical severity
dataease: Improper Neutralization of Special Elements used in an SQL Command
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
- 9.8 Critical severity
dataease: Deserialization of Untrusted Data
Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target t