SB2026041645 - Multiple vulnerabilities in DataEase

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026041645

SB2026041645 - Multiple vulnerabilities in DataEase

Published: April 16, 2026

Security Bulletin ID SB2026041645
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2025-62422)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the /de2api/datasetData/tableField interface when handling a crafted tableName parameter. A remote user can send a specially crafted request to execute arbitrary SQL commands.

Exploitation requires access to the vulnerable interface and the ability to supply the tableName parameter.


2) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-ID: CVE-2025-62421)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to improper access control in the StaticResourceApi upload route when handling crafted file upload requests that use a whitelisted script-like path. A remote user can upload a crafted HTML file and access it through a path ending in a permitted extension to execute arbitrary script in a user's browser.


3) Improper input validation (CVE-ID: CVE-2025-62420)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in the getJdbc function in H2.java when handling datasource validation requests. A remote attacker can send a specially crafted request to execute arbitrary code.

The issue arises because the check validates that jdbcUrl starts with "jdbc:h2" while the actual connection URL is taken from the separate jdbc field, allowing use of an arbitrary JDBC driver and connection URL.


4) Improper input validation (CVE-ID: CVE-2025-62419)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to trigger outbound requests to an attacker-controlled server.

The vulnerability exists due to improper input validation in the db2 and Mongo data source JDBC URL construction logic when processing user-supplied connection parameters. A remote user can supply a malicious JDBC string in the hostname field to trigger outbound requests to an attacker-controlled server.

The issue is triggered when the Get Schema function processes a data source configuration with empty extraParams.


Remediation

Install update from vendor's website.

References