CVE-2026-32137 — DataEase SQL Injection Vulnerability
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL state…
Published: 2026-03-12 · CVSS: 9.3 · CVSS 4.0
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7