CVE-2026-123990 | DataEase up to 2.10.27/3.1.0 Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb operator sql injection

A vulnerability classified as critical was found in DataEase up to 2.10.27/3.1.0. Affected is the function ExtWhere2Str.extWhere2sqlOjb of the file engine/trans/ExtWhere2Str.java of the component Chart Data Handler. Such manipulation of the argument operator leads to sql injection.

This vulnerability is listed as CVE-2026-123990. The attack may be performed from remote. In addition, an exploit is available.

Upgrading the affected component is advised.

The vendor confirms: “The fix validates the complete compound operator and uses fixed AND / OR keywords instead of concatenating user-controlled logic into SQL.”VulDB Recent EntriesRead More