WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product dataease✕
Overview 10 matches · 1 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
10matches 1in Waratek scope10.0% 0protected0.0% 1exploited10.0% 0CISA KEV0.0% 1public PoC10.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 10.0% Outside Waratek scope 0 0.0% Not applicable 9 90.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 10 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 10.0% Working exploit published 0 0.0% Proof of concept only 7 70.0% Forecast only 0 0.0% No public exploit 2 20.0%
split by peak 2 / quarter
Not applicable: 9No exploit published: 1 Medium: 10 not blocked: 10 No public exploit: 2Proof of concept only: 7Exploited: 1
Q3 221 No exploit published1 Medium1 not blocked1 No public exploit1 Q4 220 Q1 231 Not applicable1 Medium1 not blocked1 Proof of concept only1 Q2 232 Not applicable2 Medium2 not blocked2 Proof of concept only2 Q3 231 Not applicable1 Medium1 not blocked1 Proof of concept only1 Q4 230 Q1 240 Q2 241 Not applicable1 Medium1 not blocked1 Exploited1 Q3 240 Q4 240 Q1 250 Q2 252 Not applicable2 Medium2 not blocked2 Proof of concept only2 Q3 250 Q4 251 Not applicable1 Medium1 not blocked1 No public exploit1 Q1 261 Not applicable1 Medium1 not blocked1 Proof of concept only1
Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-32139 Medium 2026-03-12 Not applicable Proof of concept only Dataease is an open source data visualization analysis tool. In DataEase 2.10.19 and earlier, the static resource upload interface allows SVG uploads. However, backend validation only checks whether the XML is parseable and whether the root node is svg. It does not sanitize active content such as onload/onerror event handlers or script-capable attributes. As a result, an attacker can upload a malicious SVG and then trigger script execution in a browser by visiting the exposed static resource URL, forming a full stored XSS exploitation chain. This vulnerability is fixed in 2.10.20.
CVE-2025-62421 Medium 2025-10-17 Not applicable No public exploit DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scripting vulnerability exists due to improper file upload validation and authentication bypass. The StaticResourceApi interface defines a route upload/{fileId} that uses a URL path parameter where both the filename and extension of uploaded files are controllable by users. During permission validation, the TokenFilter invokes the WhitelistUtils#match method to determine if the URL path is in the allowlist. If the requestURI ends with .js or similar extensions, it is directly deemed safe and bypasses permission checks. This allows an attacker to access "upload/1.js" while specifying arbitrary file extensions, enabling the upload of HTML files containing malicious JavaScript. The vulnerability is fixed in version 2.10.14. No known workarounds exist.
CVE-2025-48999 Medium 2025-06-03 Not applicable Proof of concept only DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, `getUrlType()` retrieves `hostName`. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at the replace location to construct a malicious JDBC statement. Version 2.10.10 contains a patch for the issue.
CVE-2025-46566 Medium 2025-05-01 Not applicable Proof of concept only DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.9.
CVE-2024-30269 Medium 2024-04-08 Not applicable Exploited DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
CVE-2023-37257 Medium 2023-07-25 Not applicable Proof of concept only DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-site scripting vulnerability. The vulnerability has been fixed in v1.18.9. There are no known workarounds.
CVE-2023-35168 Medium 2023-06-26 Not applicable Proof of concept only DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.
CVE-2023-35164 Medium 2023-06-26 Not applicable Proof of concept only DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-28435 Medium 2023-03-24 Not applicable Proof of concept only Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.
CVE-2022-34112 Medium 2022-07-22 No exploit published No public exploit An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.