Loading story…
DataEase disclosed and patched two high-severity SQL injection vulnerabilities affecting versions 2.10.20 and earlier of its open-source data visualization and analytics platform. The first flaw, tracked as CVE-2026-33083, stems from improper handling of the user-controlled orderDirection parameter in dataset-related endpoints, where attacker-supplied input is inserted into an SQL ORDER BY clause without validation. An authenticated attacker could exploit the issue over the network to run arbitrary SQL, enabling time-based blind data extraction and denial-of-service conditions.
A second flaw, CVE-2026-33121, affects the datasource save flow, where the deTableName field from a Base64-encoded datasource configuration is unsafely inserted into a DDL statement through string replacement. That weakness allows an authenticated attacker to inject arbitrary SQL and use error-based techniques to extract database details such as the MySQL version. Both issues are classified as CWE-89 and were fixed in DataEase 2.10.21, with the vulnerabilities carrying high impact across confidentiality, integrity, and availability.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
A sixth SQL injection vulnerability, CVE-2026-40900, was disclosed for DataEase 2.10.20 and earlier. The flaw affects the /de2api/datasetData/previewSql endpoint, where an authenticated attacker with valid datasource credentials can bypass single-query assumptions and execute stacked SQL statements for read and write access; it was fixed in version 2.10.21.
A fifth SQL injection vulnerability, CVE-2026-33122, was disclosed for DataEase 2.10.20 and earlier. The flaw affects the /de2api/datasource/update endpoint, where the deTableName value is inserted into a CREATE TABLE statement without sanitization, allowing an authenticated attacker to perform error-based SQL injection; it was fixed in version 2.10.21.
A fourth SQL injection vulnerability, CVE-2026-33207, was disclosed for DataEase 2.10.20 and earlier. The flaw affects the /datasource/getTableField endpoint and allows an authenticated attacker to bypass validation via a malicious API datasource and execute arbitrary SQL; it was fixed in version 2.10.21.
A third SQL injection flaw, CVE-2026-33084, was disclosed for DataEase 2.10.20 and earlier. The issue affects the /de2api/datasetData/enumValueObj endpoint, where the sort parameter can be abused by an authenticated attacker for time-based blind SQL injection, and was fixed in version 2.10.21.
Two CVEs were published for DataEase on April 16, 2026: CVE-2026-33083 covering SQL injection in an ORDER BY clause and CVE-2026-33121 covering SQL injection in the datasource save flow. Both vulnerabilities allow authenticated attackers to inject arbitrary SQL commands and affect DataEase 2.10.20 and earlier.
DataEase fixed two SQL injection vulnerabilities affecting versions 2.10.20 and earlier in release 2.10.21. The issues involved unsafe handling of the orderDirection parameter in dataset endpoints and the deTableName field in the datasource save flow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two disclosed SQL injection vulnerabilities affect **Saltcorn** and **Dagster**, allowing authenticated users to execute unintended database queries and access data beyond their assigned privileges. In Saltcorn, the flaw in mobile sync endpoints can bypass application-level authorization controls to extract arbitrary table contents, including sensitive records from `_sc_config` and bcrypt password hashes from the `users` table. The exposure can also include active administrative session identifiers in some deployments, creating a direct path to account takeover. The impact extends beyond data exposure in several configurations. Saltcorn deployments using PostgreSQL may permit stacked queries, enabling attackers to run DML or DDL statements that delete tables, alter configuration, and escalate from a low-privileged account to full administrative control. In Dagster, injected SQL runs with the privileges assigned to the platform's database credentials, which often include broad read, write, and delete access to warehouse data. The risk is particularly acute in Dagster OSS, where limited RBAC means users with API access may be able to trigger the flaw, while Dagster+ reduces default exposure but can still permit privilege escalation under custom RBAC settings.
Jun 29, 2026
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
WeGIA, a web management platform for charitable institutions, was found to contain two SQL-related vulnerabilities that could let attackers manipulate or fully compromise backend databases. **CVE-2026-33134** affects version `3.6.5` and earlier in `/html/matPat/restaurar_produto.php`, where the `id_produto` parameter is incorporated into SQL queries without proper sanitization, enabling authenticated time-based blind SQL injection and arbitrary SQL command execution. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N` and was fixed in version `3.6.6`. A second flaw, **CVE-2026-33133**, affects versions `3.6.5` and `3.6.6` in the `loadBackupDB()` function, which imports SQL files from uploaded backup archives without validating their contents. A privileged attacker can submit a crafted backup archive containing malicious SQL to create rogue administrator accounts, reset passwords, or perform other unauthorized database operations. The issue is tracked as `CWE-89`, was introduced in commit `370104c`, and was patched in WeGIA version `3.6.7`.
Jun 29, 2026