SQLBot

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. SQLBot: RCE via SQL Injection in Excel Upload EndpointCVE-2026-32950dataease · CVSS 8.6 · 0.9% likely

   CWE-89

2. Dataease SQLBot API Endpoint assistant.py access controlCVE-2025-15597Dataease · CVSS 6.3 · 0.6% likely

   CWE-266

3. SQLBot prompt injection allows arbitrary SQL execution and remote code executionCVE-2026-33324dataease · CVSS 9.4 · 0.6% likely

   CWE-89

4. SQLBot: Remote Code Execution via Terminology PoisoningCVE-2026-32622dataease · CVSS 8.6 · 0.6% likely

   CWE-862

5. Stored XSS via SVG UploadCVE-2026-53555dataease · CVSS 5.1 · 0.5% likely

   CWE-79

6. SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File ReadCVE-2026-53556dataease · CVSS 6 · 0.5% likely

   CWE-89

7. SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerabilityCVE-2025-69285dataease · CVSS 7.7 · 0.5% likely

   CWE-306

8. SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQLCVE-2026-32949dataease · CVSS 8.7 · 0.5% likely

   CWE-918

9. SQLBot through 1.10.3 Path Traversal via datasource importToDb EndpointCVE-2026-121453dataease · CVSS 2.7 · 0.4% likely

   CWE-22

10. SQLBot through 1.10.1 Improper Access Control via Dashboard UpdateCVE-2026-93660dataease · CVSS 6.5 · 0.4% likely

    CWE-639

11. SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import ProcessingCVE-2026-53554dataease · CVSS 7.3 · 0.4% likely

    CWE-22

12. SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command ExecutionCVE-2026-53557dataease · CVSS 7.7 · 0.3% likely

    CWE-89

13. SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-htmlCVE-2026-72743dataease · CVSS 5.4 · 0.3% likely

    CWE-79

14. SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5CVE-2026-129127dataease · CVSS 4.4 · 0.3% likely

    CWE-916

15. SQLBot: Unauthorized Access VulnerabilityCVE-2026-42463dataease · CVSS 8.6 · 0.2% likely

    CWE-639

16. Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgeryCVE-2026-5417Dataease · CVSS 4.7 · 0.2% likely

    CWE-918

17. Dataease SQLBot JWT Token auth.py validateEmbedded signature verificationCVE-2025-15598Dataease · CVSS 3.7 · 0.2% likely

    CWE-347

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.