CVE-2026-33121 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: April 20, 2026
DataEase - SQL Injection
Overview
DataEase <= 2.10.20 contains a SQL injection caused by unsanitized deTableName in Base64-encoded datasource configuration used in DDL statement construction, letting authenticated attackers extract database information.
Severity & Score
Impact
Authenticated attackers can execute arbitrary SQL commands, potentially extracting sensitive database information.
Mitigation
Upgrade to version 2.10.21 or later.
References
Social Media Activity(2 posts)
š CVE-2026-33121 - High (8.8) DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is ... š https://www.thehackerwire.com/vulnerability/CVE-2026-33121/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
š CVE-2026-33121 - High (8.8) DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is ... š https://www.thehackerwire.com/vulnerability/CVE-2026-33121/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-33121
- Severity
- High
- CVSS Score
- 8.8
- Type
- sql_injection
- Status
- confirmed
- EPSS
- 3.0%
- Social Posts
- 2
CWE
- CWE-89
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H