{"items":[{"id":"CVE-2026-121453","published":"2026-11-03T15:17:02.458Z","updated":"2026-11-03T16:52:31.501Z","title":"SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint","severity":"MEDIUM","score":5.1,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-93660","published":"2026-09-18T14:23:22.267Z","updated":"2026-09-22T14:36:08.735Z","title":"SQLBot through 1.10.1 Improper Access Control via Dashboard Update","severity":"HIGH","score":7.1,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-53557","published":"2026-09-17T21:41:45.155Z","updated":"2026-09-22T01:54:15.476Z","title":"SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution","severity":"HIGH","score":7.7,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00336,"kevAdded":null},{"id":"CVE-2026-53555","published":"2026-09-17T21:40:48.271Z","updated":"2026-09-18T13:14:53.154Z","title":"Stored XSS via SVG Upload","severity":"MEDIUM","score":5.1,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-53556","published":"2026-09-17T21:39:44.056Z","updated":"2026-09-18T20:01:34.847Z","title":"SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read","severity":"MEDIUM","score":6,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-53554","published":"2026-09-17T21:38:37.353Z","updated":"2026-09-18T13:16:54.601Z","title":"SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing","severity":"HIGH","score":7.3,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-72743","published":"2026-08-10T20:06:32.158Z","updated":"2026-08-17T18:18:07.729Z","title":"SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html","severity":"MEDIUM","score":5.1,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-42463","published":"2026-05-13T21:26:27.821Z","updated":"2026-05-14T13:40:32.770Z","title":"SQLBot: Unauthorized Access Vulnerability","severity":"HIGH","score":8.6,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-33324","published":"2026-05-05T19:09:36.031Z","updated":"2026-05-05T19:38:28.127Z","title":"SQLBot prompt injection allows arbitrary SQL execution and remote code execution","severity":"CRITICAL","score":9.4,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2026-5417","published":"2026-04-02T18:15:11.883Z","updated":"2026-04-03T20:00:17.177Z","title":"Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery","severity":"MEDIUM","score":5.1,"vendor":"Dataease","product":"SQLbot","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-32950","published":"2026-03-20T04:14:45.640Z","updated":"2026-03-24T01:49:10.552Z","title":"SQLBot: RCE via SQL Injection in Excel Upload Endpoint","severity":"HIGH","score":8.6,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00913,"kevAdded":null},{"id":"CVE-2026-32949","published":"2026-03-20T04:08:43.142Z","updated":"2026-03-20T19:50:35.555Z","title":"SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL","severity":"HIGH","score":8.7,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-32622","published":"2026-03-19T20:55:51.987Z","updated":"2026-03-24T01:40:19.077Z","title":"SQLBot: Remote Code Execution via Terminology Poisoning","severity":"HIGH","score":8.6,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2025-15598","published":"2026-03-03T09:32:06.880Z","updated":"2026-03-03T14:33:05.697Z","title":"Dataease SQLBot JWT Token auth.py validateEmbedded signature verification","severity":"MEDIUM","score":6.3,"vendor":"Dataease","product":"SQLBot","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2025-15597","published":"2026-03-02T06:16:35.439Z","updated":"2026-03-02T13:55:07.407Z","title":"Dataease SQLBot API Endpoint assistant.py access control","severity":"MEDIUM","score":5.3,"vendor":"Dataease","product":"SQLBot","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2025-69285","published":"2026-01-21T20:05:22.108Z","updated":"2026-01-21T21:27:55.889Z","title":"SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability","severity":"HIGH","score":7.7,"vendor":"dataease","product":"SQLBot","kev":false,"epss":0.00455,"kevAdded":null}]}