Running-elephant
Running-elephant Datart: vulnerabilidades y CVE
Running-elephant Datart tiene 8 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE8
Últimos 12 meses3
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-70830 | Crítica (9.9) | 1.0% | — | 17 feb 2026 | A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax… |
| CVE-2025-70828 | Alta (8.8) | 0.49% | — | 17 feb 2026 | An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration |
| CVE-2025-70829 | Media (5.7) | 0.45% | — | 17 feb 2026 | An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string. |
| CVE-2025-56816 | Alta (8.8) | 1.4% | — | 24 sept 2025 | Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses… |
| CVE-2025-56815 | Alta (7.1) | 0.62% | — | 24 sept 2025 | Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks… |
| CVE-2025-56819 | Crítica (9.8) | 3.2% | — | 24 sept 2025 | An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. |
| CVE-2025-10080 | Baja (1.3) | 0.26% | — | 8 sept 2025 | A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file datart/security/src/main/java/datart/security/util/AESUtil.java of the… |
| CVE-2024-12994 | Media (5.3) | 0.54% | — | 28 dic 2024 | A vulnerability was found in running-elephant Datart 1.0.0-rc3. It has been rated as critical. Affected by this issue is the function extractModel of the file /import of the component File Upload. The manipulation of… |