Dataease 2.10.20 contains a flaw in the SqlparserUtils.transFilter method which allows an attacker to inject malformed SQL directly into queries executed by the Data Dashboard component. This creates a traditional SQL injection vector that can expose, alter or delete data contained in the database. The CVSS score of 5.1 indicates a moderate severity and confirms that the vulnerability can be exploited without requiring privileged local access.

The single affected platform is Dataease, specifically the 2.10.20 release. No additional versions or variants are listed.

The exploit is publicly available and can be launched remotely, likely through a request to the Data Dashboard service. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the combination of remote access and SQL injection still poses a moderate threat. An attacker who can reach the dashboard can execute arbitrary database statements against the underlying Dataease data store.