GCVE - cpe:2.3:a:running-elephant:datart:1.0.0:rc3:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:running-elephant:datart:1.0.0:rc3:*:*:*:*:*:*

part: a version: 1.0.0 update: rc3

Vendor	Running Elephant (`42998611-8399-5e23-bbd0-51cad653a8ed`)
Product	Datart (`f72996cc-6c8c-5acb-81d1-0c3309cdadbe`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:gitee/running-elephant/datart`	purl2cpe	2026-06-01 10:14:06.178263
`pkg:github/running-elephant/datart`	purl2cpe	2026-06-01 10:14:06.178266

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-70829`	vulnerable	2026-06-08 07:43:17.031924	Details available An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string. Published: 2026-02-17T00:00:00.000Z Updated: 2026-02-17T15:38:47.790Z Open on db.gcve.eu Reference links https://github.com/running-elephant/datart https://github.com/xiaoxiaoranxxx/CVE-2025-70829	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-70828`	vulnerable	2026-06-08 07:43:17.031550	Details available An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration Published: 2026-02-17T00:00:00.000Z Updated: 2026-02-19T17:47:20.507Z Open on db.gcve.eu Reference links https://dev.mysql.com/doc/connector-j/en/connector-j-connprops-interceptor-classes-and-interfaces.html https://github.com/xiaoxiaoranxxx/CVE-2025-70828	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56819`	vulnerable	2026-06-08 07:33:15.762469	Details available An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. Published: 2025-09-24T00:00:00.000Z Updated: 2025-09-24T19:11:48.366Z Open on db.gcve.eu Reference links https://h2database.com/html/features.html#runscript https://github.com/h2database/h2database https://github.com/xyyzxc/CVE-2025-56819	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56816`	vulnerable	2026-06-08 07:33:15.762128	Details available Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load() or loadAs() method without input sanitization. This allows deserialization of attacker-controlled YAML content, leading to arbitrary class instantiation. Under certain conditions, this can be exploited to achieve remote code execution (RCE). Published: 2025-09-24T00:00:00.000Z Updated: 2025-09-24T17:18:26.606Z Open on db.gcve.eu Reference links https://github.com/running-elephant/datart https://github.com/xiaoxiaoranxxx/CVE-2025-56815	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56815`	vulnerable	2026-06-08 07:33:15.761698	Details available Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name. Published: 2025-09-24T00:00:00.000Z Updated: 2025-09-24T17:23:05.934Z Open on db.gcve.eu Reference links https://github.com/running-elephant/datart/tags https://github.com/xiaoxiaoranxxx/CVE-2025-56815	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Datart

Notes

PURL mappings

Vulnerability references

Contribute