SQL Injection

Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.

1. DataEase has a SQL injection vulnerability that can bypass blacklistsCVE-2023-37258dataease · CVSS 8.8 · 1.1% likely

   CWE-89

2. Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read VulnerabilityCVE-2024-55953dataease · CVSS 8.6 · 1.0% likely

   CWE-89

3. SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.CVE-2023-40771Dataease · 1.0% likely

   CWE-89

4. Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.CVE-2022-34114Dataease · 0.9% likely

   CWE-89

5. SQLBot: RCE via SQL Injection in Excel Upload EndpointCVE-2026-32950dataease · CVSS 8.6 · 0.9% likely

   CWE-89

6. SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassedCVE-2023-28437dataease · CVSS 9.8 · 0.9% likely

   CWE-89

7. SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.CVE-2021-38239Dataease · CVSS 7.5 · 0.7% likely

   CWE-89

8. SQLBot prompt injection allows arbitrary SQL execution and remote code executionCVE-2026-33324dataease · CVSS 9.4 · 0.6% likely

   CWE-89

9. DataEase SQL injection vulnerabilityCVE-2025-62422dataease · CVSS 8.7 · 0.5% likely

   CWE-89

10. Dataease MYSQL JDBC File Reading VulnerabilityCVE-2025-48998dataease · CVSS 7.3 · 0.5% likely

    CWE-89

11. SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File ReadCVE-2026-53556dataease · CVSS 6 · 0.5% likely

    CWE-89

12. DataEase SQL Injection VulnerabilityCVE-2026-32137dataease · CVSS 9.3 · 0.5% likely

    CWE-89

13. DataEase: Arbitrary SQL execution in preview path (direct data disclosure)CVE-2026-50030dataease · CVSS 7.1 · 0.5% likely

    CWE-89

14. DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL InjectionCVE-2026-45320dataease · CVSS 8.7 · 0.5% likely

    CWE-89

15. Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability​CVE-2025-27103dataease · CVSS 7.3 · 0.5% likely

    CWE-89

16. DataEase: Authenticated SQL Injection in Chart Quota FiltersCVE-2026-55635dataease · CVSS 8.7 · 0.4% likely

    CWE-89

17. DataEase has SQL Injection via Datasource ManagementCVE-2026-33122dataease · CVSS 8.6 · 0.4% likely

    CWE-89

18. Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injectionCVE-2026-8724Dataease · CVSS 4.7 · 0.4% likely

    CWE-89

19. DataEase: Stored SQL Injection VulnerabilityCVE-2026-45535dataease · CVSS 8.7 · 0.4% likely

    CWE-89

20. DataEase: SQL injection vulnerabilityCVE-2026-45417dataease · CVSS 8.7 · 0.4% likely

    CWE-89

21. DataEase has SQL Injection via Stacked QueriesCVE-2026-40900dataease · CVSS 8.7 · 0.4% likely

    CWE-89

22. DataEase SQL Injection VulnerabilityCVE-2026-33207dataease · CVSS 8.6 · 0.4% likely

    CWE-89

23. DataEase: Stored SQL Injection in group-field binning boundsCVE-2026-104142dataease · CVSS 8.7 · 0.4% likely

    CWE-89

24. DataEase: SQL Injection in datasource metadata identifiersCVE-2026-104141dataease · CVSS 8.7 · 0.4% likely

    CWE-89

25. SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command ExecutionCVE-2026-53557dataease · CVSS 7.7 · 0.3% likely

    CWE-89

26. DataEase has SQL Injection via Datasource Save FlowCVE-2026-33121dataease · CVSS 8.7 · 0.3% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.