CVE-2023-25807

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-258096.3runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless r CVE-2023-258105.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users CVE-2023-258115.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. U CVE-2023-258128.8Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio CVE-2023-258139.8Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are pa CVE-2023-258146.5metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file th CVE-2023-258152.2In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to CVE-2023-258166.5Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consump CVE-2023-258178.1Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their per CVE-2023-258187.1Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of CVE-2023-258195.3Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site CVE-2023-25826.1A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatio