dataease records

72 published records for vendor dataease.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 12
With a fix record: 61.1%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

72 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
50Plan	CVE-2024-56511Proof of concept	DataEase has an unauthorized vulnerabilitydataease · dataease · CWE-289 Pre-auth	Critical9.3	—	44.5%	Jan 10, 2025
47Plan	CVE-2025-49002Proof of concept	Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerabilitydataease · dataease · CWE-290 pre-auth RCE Auth bypass	High8.2	—	50.3%	Jun 3, 2025
39Monitor	CVE-2022-39312No exploit	Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerabilitydataease · dataease · CWE-20 Pre-auth Deserialization	Critical9.8	—	1.6%	Oct 25, 2022
39Monitor	CVE-2024-46997No exploit	DataEase's H2 datasource has a remote command execution riskdataease · dataease · CWE-74 pre-auth RCE	Critical9.8	—	1.4%	Sep 23, 2024
39Monitor	CVE-2023-33963No exploit	DataEase data source has deserialization vulnerabilitydataease · dataease · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	1.3%	Jun 1, 2023
39Monitor	CVE-2022-34113No exploit	An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.dataease · dataease pre-auth RCE	Critical9.8	—	1.3%	Jul 22, 2022
39Monitor	CVE-2022-34115No exploit	DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.dataease · dataease · CWE-434 Pre-auth File upload	Critical9.8	—	1.2%	Jul 22, 2022
39Monitor	CVE-2023-37258No exploit	DataEase has a SQL injection vulnerability that can bypass blacklistsdataease · dataease · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.1%	Jul 25, 2023
39Monitor	CVE-2023-28437No exploit	SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypasseddataease · dataease · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.9%	Mar 24, 2023
39Monitor	CVE-2024-57707No exploit	An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.dataease · dataease · CWE-94 pre-auth RCE	Critical9.8	—	0.8%	Feb 7, 2025
37Monitor	CVE-2024-47073Proof of concept	Dataease arbitrary interface access vulnerabilitydataease · dataease · CWE-347 Pre-auth Weak crypto	Critical9.3	—	1.3%	Nov 7, 2024
37Monitor	CVE-2026-32140No exploit	Dataease: Redshift JDBC RCE Bypassdataease · dataease · CWE-22 pre-auth RCE Path traversal	Critical9.3	—	0.9%	Mar 12, 2026
37Monitor	CVE-2024-52295No exploit	DataEase has a forged JWT token vulnerabilitydataease · dataease · CWE-798 Pre-auth Hard-coded credentials	Critical9.3	—	0.9%	Nov 13, 2024
37Monitor	CVE-2024-47074No exploit	Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerabilitydataease · dataease · CWE-502 Pre-auth Deserialization	Critical9.3	—	0.6%	Oct 11, 2024
37Monitor	CVE-2026-32137No exploit	DataEase SQL Injection Vulnerabilitydataease · dataease · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.6%	Mar 12, 2026
36Monitor	CVE-2025-49001Proof of concept	Dataease Authentication Bypass Vulnerabilitydataease · dataease · CWE-287 Pre-auth Auth bypass	High7.7	—	21.1%	Jun 3, 2025
36Monitor	CVE-2024-23328No exploit	The Dataease datasource exists deserialization and arbitrary file read vulnerabilitydataease · dataease · CWE-502 pre-auth RCE Deserialization	Critical9.1	—	1.2%	Feb 28, 2024
35Monitor	CVE-2025-57772No exploit	Dataease H2 JDBC RCE Bypassdataease · dataease · CWE-94 pre-auth RCE	High8.2	—	9.3%	Aug 25, 2025
35Monitor	CVE-2023-28637No exploit	DataEase AWS redshift data source exists for remote code execution vulnerabilitydataease · dataease · CWE-74 RCE	High8.8	—	1.3%	Mar 28, 2023
35Monitor	CVE-2022-23331No exploit	In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.dataease · dataease	High8.8	—	1.2%	Feb 8, 2022
35Monitor	CVE-2025-64163No exploit	DataEase's DB2 is vulnerable to SSRFdataease · dataease · CWE-918 Pre-auth SSRF	High8.9	—	1.1%	Nov 5, 2025
35Monitor	CVE-2025-49003No exploit	Dataease H2 JDBC Connection Remote Code Executiondataease · dataease · CWE-153 pre-auth RCE	High8.9	—	0.9%	Jun 26, 2025
35Monitor	CVE-2022-34114No exploit	Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.dataease · dataease · CWE-89 SQL injection	High8.8	—	0.9%	Jul 22, 2022
35Monitor	CVE-2025-53006No exploit	Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerabilitydataease · dataease · CWE-153 Pre-auth	High8.9	—	0.6%	Jul 2, 2025
35Monitor	CVE-2025-64164No exploit	DataEase is vulnerable to Oracle JNDI Injectiondataease · dataease · CWE-502 Pre-auth Deserialization	High8.9	—	0.6%	Nov 5, 2025

CVE-2024-56511
50Plan
DataEase has an unauthorized vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 44%
- Pre-auth
dataease · dataeaseJan 10, 2025
CVE-2025-49002
47Plan
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
HighCVSS 8.2Proof of conceptEPSS 50%
- pre-auth RCE
- Auth bypass
dataease · dataeaseJun 3, 2025
CVE-2022-39312
39Monitor
Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Deserialization
dataease · dataeaseOct 25, 2022
CVE-2024-46997
39Monitor
DataEase's H2 datasource has a remote command execution risk
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
dataease · dataeaseSep 23, 2024
CVE-2023-33963
39Monitor
DataEase data source has deserialization vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Deserialization
dataease · dataeaseJun 1, 2023
CVE-2022-34113
39Monitor
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
dataease · dataeaseJul 22, 2022
CVE-2022-34115
39Monitor
DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- File upload
dataease · dataeaseJul 22, 2022
CVE-2023-37258
39Monitor
DataEase has a SQL injection vulnerability that can bypass blacklists
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
dataease · dataeaseJul 25, 2023
CVE-2023-28437
39Monitor
SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
dataease · dataeaseMar 24, 2023
CVE-2024-57707
39Monitor
An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
dataease · dataeaseFeb 7, 2025
CVE-2024-47073
37Monitor
Dataease arbitrary interface access vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- Weak crypto
dataease · dataeaseNov 7, 2024
CVE-2026-32140
37Monitor
Dataease: Redshift JDBC RCE Bypass
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Path traversal
dataease · dataeaseMar 12, 2026
CVE-2024-52295
37Monitor
DataEase has a forged JWT token vulnerability
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Hard-coded credentials
dataease · dataeaseNov 13, 2024
CVE-2024-47074
37Monitor
Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Deserialization
dataease · dataeaseOct 11, 2024
CVE-2026-32137
37Monitor
DataEase SQL Injection Vulnerability
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- SQL injection
dataease · dataeaseMar 12, 2026
CVE-2025-49001
36Monitor
Dataease Authentication Bypass Vulnerability
HighCVSS 7.7Proof of conceptEPSS 21%
- Pre-auth
- Auth bypass
dataease · dataeaseJun 3, 2025
CVE-2024-23328
36Monitor
The Dataease datasource exists deserialization and arbitrary file read vulnerability
CriticalCVSS 9.1No exploitEPSS 1%
- pre-auth RCE
- Deserialization
dataease · dataeaseFeb 28, 2024
CVE-2025-57772
35Monitor
Dataease H2 JDBC RCE Bypass
HighCVSS 8.2No exploitEPSS 9%
- pre-auth RCE
dataease · dataeaseAug 25, 2025
CVE-2023-28637
35Monitor
DataEase AWS redshift data source exists for remote code execution vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
dataease · dataeaseMar 28, 2023
CVE-2022-23331
35Monitor
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
HighCVSS 8.8No exploitEPSS 1%
dataease · dataeaseFeb 8, 2022
CVE-2025-64163
35Monitor
DataEase's DB2 is vulnerable to SSRF
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- SSRF
dataease · dataeaseNov 5, 2025
CVE-2025-49003
35Monitor
Dataease H2 JDBC Connection Remote Code Execution
HighCVSS 8.9No exploitEPSS 1%
- pre-auth RCE
dataease · dataeaseJun 26, 2025
CVE-2022-34114
35Monitor
Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
dataease · dataeaseJul 22, 2022
CVE-2025-53006
35Monitor
Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
dataease · dataeaseJul 2, 2025
CVE-2025-64164
35Monitor
DataEase is vulnerable to Oracle JNDI Injection
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- Deserialization
dataease · dataeaseNov 5, 2025