Approved changes feed: RSS · Atom
cpe:2.3:a:datagear:datagear:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Datagear (2b73e649-ac6b-562a-9547-759bd593b1cf) |
|---|---|
| Product | Datagear (af3e1b44-42d2-5ebf-95c7-f53fbd24a24c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/datageartech/datagear |
purl2cpe | 2026-06-01 10:12:23.489278 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-92566 |
vulnerable | 2026-10-13 12:28:53.659084 |
DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
HIGH (8.2)
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services, receiving full response bodies without authentication or validation.
Published: 2026-09-16T14:40:46.475Z
Updated: 2026-09-24T14:22:39.549Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-19110 |
vulnerable | 2026-09-16 04:34:15.252552 |
DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting
LOW (2.4)
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-06T20:45:08.738Z
Updated: 2026-08-07T17:09:16.077Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7552 |
vulnerable | 2026-06-08 06:58:22.406852 |
DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection
MEDIUM (6.3)
A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of special elements used in an expression language statement. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273697 was assigned to this vulnerability.
Published: 2024-08-06T14:31:09.110Z
Updated: 2024-08-06T19:30:34.911Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37759 |
vulnerable | 2026-06-08 06:39:48.067039 |
Details available
DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface.
Published: 2024-06-24T00:00:00.000Z
Updated: 2024-08-02T03:57:39.771Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-7299 |
vulnerable | 2026-06-08 06:21:57.510263 |
DataGear resolveSql sql injection
MEDIUM (6.3)
A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.
Published: 2024-11-23T13:00:15.959Z
Updated: 2024-11-26T19:13:15.271Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2042 |
vulnerable | 2026-06-08 06:02:41.302150 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1772 |
vulnerable | 2026-06-08 05:52:37.013807 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1573 |
vulnerable | 2026-06-08 05:52:36.133705 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1572 |
vulnerable | 2026-06-08 05:52:36.133137 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1571 |
vulnerable | 2026-06-08 05:52:36.132467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.