Security Advisory

CVE-2026-32137

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-03-12 17:53:00

Last updated 2026-03-13 16:23:17

Assigner GitHub_M

State PUBLISHED

Description

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.

← Browse all CVEs View on cve.org ↗