Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the sorting metadata DTO, which is passed to Order2SQLObj where it is incorporated into the SQL ORDER BY clause without any whitelist validation, and then executed via CalciteProvider. An authenticated attacker can inject arbitrary SQL commands through the sort parameter, enabling time-based blind SQL injection. This issue has been fixed in version 2.10.21.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33084 DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /d… https://www.cve.org/CVERecord?id=CVE-2026-33084
Post summary
The tweet announces CVE-2026-33084, noting a SQL injection flaw in DataEase's sort parameter for versions 2.10.20 and earlier, and provides a link to the official CVE record.
CVE-2026-33084 SQL Injection in DataEase Versions 2.10.20 and Below via Sort Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33084
Post summary
The text announces a newly disclosed SQL Injection vulnerability in DataEase 2.10.20 and earlier via the Sort parameter.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dataease | dataease | - | - | - |