Product by Dataease
SQLBot
15 known vulnerabilities in SQLBot (Dataease), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-32950 | SQLBot: RCE via SQL Injection in Excel Upload Endpoint | 8.8 | |
| Critical | CVE-2026-33324 | SQLBot prompt injection allows arbitrary SQL execution and remote code execution | 8.8 | |
| High | CVE-2026-32622 | SQLBot: Remote Code Execution via Terminology Poisoning | 8.8 | |
| High | CVE-2026-53554 | Dataease SQLBot: Path Traversal | — | |
| High | CVE-2026-93660 | SQLBot through 1.10.1 Improper Access Control via Dashboard Update | 6.5 | |
| High | CVE-2026-53557 | SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution | — | |
| Medium | CVE-2026-53556 | SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read | — | |
| High | CVE-2026-32949 | SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL | 7.5 | |
| Medium | CVE-2026-53555 | Stored XSS via SVG Upload | — | |
| Medium | CVE-2025-15597 | Dataease SQLBot API Endpoint assistant.py access control | 6.3 | |
| High | CVE-2025-69285 | SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability | 6.1 | |
| High | CVE-2026-42463 | SQLBot: Unauthorized Access Vulnerability | 8.1 | |
| Medium | CVE-2026-72743 | SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html | 5.4 | |
| Medium | CVE-2025-15598 | Dataease SQLBot JWT Token auth.py validateEmbedded signature verification | 3.7 | |
| Medium | CVE-2026-5417 | Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery | 4.7 |