CVE-2026-32137 – DataEase SQL Injection Vulnerability

CVE ID :CVE-2026-32137

Published : March 12, 2026, 5:53 p.m. | 33 minutes ago

Description :Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…