dataease SQLBot vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Latest dataease SQLBot vulnerabilities

CVE-2026-93660 — SQLBot through 1.10.1 Improper Access Control via Dashboard Update (CVSS 6.5)
CVE-2026-53557 — SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution (CVSS 7.7)
CVE-2026-53556 — SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read (CVSS 6.0)
CVE-2026-53555 — Stored XSS via SVG Upload (CVSS 5.1)
CVE-2026-53554 — SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing (CVSS 7.3)
CVE-2026-72743 — SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html (CVSS 5.4)
CVE-2026-42463 — SQLBot: Unauthorized Access Vulnerability (CVSS 8.1)
CVE-2026-33324 — SQLBot prompt injection allows arbitrary SQL execution and remote code execution (CVSS 8.8)
CVE-2026-5417 — Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery (CVSS 4.7)
CVE-2026-32950 — SQLBot: RCE via SQL Injection in Excel Upload Endpoint (CVSS 8.8)
CVE-2026-32949 — SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL (CVSS 7.5)
CVE-2026-32622 — SQLBot: Remote Code Execution via Terminology Poisoning (CVSS 8.8)
CVE-2025-15598 — Dataease SQLBot JWT Token auth.py validateEmbedded signature verification (CVSS 5.9)
CVE-2025-15597 — Dataease SQLBot API Endpoint assistant.py access control (CVSS 6.3)
CVE-2025-69285 — SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability (CVSS 6.1)