CVE-2023-28437

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-284388.0Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can alreaCVE-2023-284396.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting IfrCVE-2023-28444.9Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-284402.7Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrCVE-2023-284417.5smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stoCVE-2023-284425.3GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.CVE-2023-284435.5Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is noCVE-2023-284447.5angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment vCVE-2023-284459.8Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions tCVE-2023-284468.8Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names withoutCVE-2023-284476.1Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulCVE-2023-284487.5Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast des
CVE-2023-28437: Critical severity, CVSS 9.8 | Vulnix