SQL Injection Vulnerability in DataEase Chart Data Handler
CVE-2026-123990

6.9MEDIUM

Key Information:

Vendor

DataEase

Status
Dataease
Vendor
CVE Published:
7 November 2026

What is CVE-2026-123990?

A security vulnerability exists in the Chart Data Handler of DataEase, based on improper handling of the argument operator in the function ExtWhere2Str.extWhere2sqlOjb. This flaw may allow remote attackers to exploit SQL injection, potentially leading to unauthorized access to sensitive data. It is crucial for users to upgrade to version 3.2.0, which implements a fix that validates compound operators and utilizes fixed AND/OR keywords rather than concatenating user input into SQL commands, thus mitigating risks associated with this vulnerability.

Affected Version(s)

DataEase 2.10.0

DataEase 2.10.1

DataEase 2.10.2

References

https://vuldb.com/vuln/432069
vdb-entrytechnical-description
https://vuldb.com/vuln/432069/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-123990
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.