Threat database

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services, receiving full response bodies without authentication or validation.

CVE-2026-19110 is a cross-site scripting (XSS) vulnerability in DataGear version 5.0.0. The issue exists in the HtmlTplDashboardWidgetHtmlRenderer function of the Chart Name Handler component, where manipulation of the Title argument can lead to XSS. The vulnerability can be exploited remotely and has been publicly disclosed. The vendor has not responded or provided a fix. The CVSS score is 4.8, indicating a medium severity risk.

DataGear v5.5.0 is vulnerable to Arbitrary File Deletion.

DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface.