cve.bz

gcpaas dataroom vulnerabilities, newest first

Filter
  1. 6.0CVE-2026-125381EPSS 0.3%

    DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dat…

  2. 7.1CVE-2026-125380EPSS 0.3%

    DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSource…