CVE-2026-8724
Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- May 17, 2026
- Updated
- May 18, 2026
- Reserved
- May 16, 2026
Description
A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component Data Dashboard. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Dataeasen/a |
|
References
- VDB-364315 | Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injectionvdb-entrytechnical-description
- VDB-364315 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #804256 | Dataease dataease v2.10.20 SQL Injectionthird-party-advisory
- https://github.com/xpp3901/CVE_APPLY/tree/main/V-D001_DataEase_SqlVariable_Injectionexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.