Cross-site Scripting

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. DataEase dashboard has a stored XSS vulnerabilityCVE-2023-25807dataease · CVSS 7.2 · 0.5% likely

   CWE-79

2. Stored XSS via SVG UploadCVE-2026-53555dataease · CVSS 5.1 · 0.5% likely

   CWE-79

3. DataEase: authenticated stored XSS in the dashboard text componentsCVE-2026-55647dataease · CVSS 5.1 · 0.5% likely

   CWE-79

4. DataEase: Authenticated Stored XSS in DataEase Template Static ResourcesCVE-2026-49867dataease · CVSS 6.3 · 0.5% likely

   CWE-79

5. Dataease file upload interface does not verify permission or file typeCVE-2023-28435dataease · CVSS 6.5 · 0.5% likely

   CWE-79

6. The DataEase panel and dataset have a stored XSS vulnerabilityCVE-2023-37257dataease · CVSS 5.4 · 0.4% likely

   CWE-79

7. DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site ScriptingCVE-2026-102756dataease · CVSS 5.1 · 0.4% likely

   CWE-79

8. DataEase Datasource/Dataset Folder Name Stored Cross-Site ScriptingCVE-2026-102755dataease · CVSS 5.1 · 0.4% likely

   CWE-79

9. DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scriptingCVE-2026-123992Dataease · CVSS 4.3 · 0.3% likely

   CWE-79

10. SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-htmlCVE-2026-72743dataease · CVSS 5.4 · 0.3% likely

    CWE-79

11. DataEase vulnerable to stored cross-site scripting via file upload bypassCVE-2025-62421dataease · CVSS 5.5 · 0.3% likely

    CWE-79

12. Dataease: Unfiltered active SVG content leads to Stored XSSCVE-2026-32139dataease · CVSS 5.3 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.