Approved changes feed: RSS · Atom
cpe:2.3:a:lf-edge:ekuiper:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Lf Edge (265ebbe1-50c8-5f0b-8b8d-0ba8f4142dd1) |
|---|---|
| Product | Ekuiper (ee0cdfd9-0db8-5d50-8e52-46bb9e208ee9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-54379 |
vulnerable | 2026-06-08 07:33:12.508505 |
eKuiper API endpoints handling SQL queries with user-controlled table names.
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.
Published: 2025-07-24T22:24:23.709Z
Updated: 2025-07-25T13:26:34.392Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52812 |
vulnerable | 2026-06-08 06:52:16.271636 |
LF Edge eKuiper has Stored XSS in Rules Functionality
MEDIUM (5.4)
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
Published: 2025-03-10T17:52:13.106Z
Updated: 2025-03-11T20:13:01.144Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52290 |
vulnerable | 2026-06-08 06:52:14.728893 |
Stored XSS in Configuration Key Functionality
MEDIUM (6.3)
LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.
Published: 2025-05-14T07:19:50.045Z
Updated: 2025-05-14T13:21:31.315Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-43406 |
vulnerable | 2026-06-08 06:45:50.698500 |
LF Edge eKuiper has a SQL Injection in sqlKvStore
HIGH (8.8)
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.
Published: 2024-08-20T15:00:06.571Z
Updated: 2024-08-20T17:42:14.854Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.