CVE-2026-32137Disclosure(dataease / dataease)

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.

dataease CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/dataease/dataease/security/advisories/GHSA-vgm2-269h-8624

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dataease

Threat summary

Public PoC is present in monitored signal
4 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 2 mentions (2026-03-12); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

dataease

Products

dataease

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets5 URLs

By indicator

Full discourse4 posts

The Hacker Wire@TheHackerWire211d
Disclosure
🟠 CVE-2026-32137 - High Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without a... https://www.thehackerwire.com/vulnerability/CVE-2026-32137/ https://t.co/BWV5bdREHm
Post summary
The tweet discloses that CVE-2026-32137 is a SQL injection flaw in Dataease's preview API before version 2.10.20.
0000041
134 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds212d
Disclosure
CVE-2026-32137 SQL Injection Vulnerability in DataEase Before Version 2.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32137 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces a SQL injection vulnerability affecting DataEase versions prior to 2, links to a detail page, but offers no evidence of exploits, patches, or active attacks.
0000056
4.0K followersView on X
CVE@CVEnew212d
Disclosure
CVE-2026-32137 Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into th… https://www.cve.org/CVERecord?id=CVE-2026-32137
Post summary
The text discloses that Dataease versions before 2.10.20 are vulnerable due to SQL injection via the /de2api/datasource/previewData endpoint. No PoC, exploit, or patch details are provided.
00000150
56.7K followersView on X
0day Signal@0dayPublishing212d
Disclosure
🚨 CVE-2026-32137: DataEase SQL Injection Vulnerabi... String concatenation SQLi in DataEase's /de2api/datasource/previewData endpoint - zero auth required, direct DB access ... https://zerodaysignal.com/vulnerability/CVE-2026-32137 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces a zero‑authentication SQL injection in DataEase’s previewData endpoint, linking to a vulnerability page but providing no exploit, patch, or active‑use details.
0000054
143 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dataease	dataease	-	-	-

Explore more

Back to dashboard dataease CVEs dataease vulnerabilities

What researchers are saying

CVE-2026-32137

The Hacker Wire@TheHackerWireDisclosure

The tweet discloses that CVE-2026-32137 is a SQL injection flaw in Dataease's preview API before version 2.10.20.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a SQL injection vulnerability affecting DataEase versions prior to 2, links to a detail page, but offers no evidence of exploits, patches, or active attacks.

CVE@CVEnewDisclosure

The text discloses that Dataease versions before 2.10.20 are vulnerable due to SQL injection via the /de2api/datasource/previewData endpoint. No PoC, exploit, or patch details are provided.

0day Signal@0dayPublishingDisclosure

The post announces a zero‑authentication SQL injection in DataEase’s previewData endpoint, linking to a vulnerability page but providing no exploit, patch, or active‑use details.