PT-2026-41470 · Dataease · Dataease

Xpp39 · Published 2026-05-17 · Updated 2026-05-17 · CVE-2026-8724

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dataease version 2.10.20

Description A security flaw in the Data Dashboard component allows for remote SQL injection. This issue occurs within the SqlparserUtils.transFilter() function located in the SqlparserUtils.java file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the SqlparserUtils.transFilter() function to minimize the risk of exploitation.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-8724

Affected Products

Dataease

References · 9

• 🔥 https://github.com/xpp3901/CVE_APPLY/tree/main/V-D001_DataEase_SqlVariable_Injection · Exploit
• 🔥 https://vuldb.com/submit/804256 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8724 · Security Note
• https://twitter.com/CVEnew/status/2055866557977293099 · Twitter Post
• https://vuldb.com/vuln/364315 · Note
• https://vuldb.com/vuln/364315/cti · Note
• https://t.me/cveNotify/163755 · Telegram Post
• https://t.me/CVEtracker/54025 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055843893426430312 · Twitter Post