CVE-2023-7299

5.3 mediumEPSS 0.6%

A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-74
Published: 2024-11-23
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

Affected

datagear:datagear

References

https://github.com/datageartech/datagear/issues/29
https://vuldb.com/?ctiid.285658
https://vuldb.com/?id.285658
https://vuldb.com/?submit.442943

Check your stack JSON