Knowage
by Knowagelabs
CVEs (12)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-58441 | 0.00 | — | 0.00 | Jan 7, 2026 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the… | |||
| CVE-2025-59954 | 0.00 | — | 0.00 | Sep 29, 2025 | Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27. | |||
| CVE-2025-55007 | 0.00 | — | 0.00 | Sep 1, 2025 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response,… | |||
| CVE-2023-35154 | 0.00 | — | 0.00 | Jun 23, 2023 | Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a… | |||
| CVE-2019-14278 | 0.00 | — | 0.00 | Sep 5, 2019 | In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page. | |||
| CVE-2019-13349 | 0.00 | — | 0.01 | Sep 5, 2019 | In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes. | |||
| CVE-2019-13190 | 0.00 | — | 0.00 | Sep 5, 2019 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. | |||
| CVE-2019-13348 | 0.00 | — | 0.01 | Aug 28, 2019 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases. | |||
| CVE-2019-13189 | 0.00 | — | 0.00 | Aug 28, 2019 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. | |||
| CVE-2018-12355 | 0.00 | — | 0.00 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. | |||
| CVE-2018-12354 | 0.00 | — | 0.00 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request. | |||
| CVE-2018-12353 | 0.00 | — | 0.00 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue. |
- CVE-2025-58441Jan 7, 2026risk 0.00cvss —epss 0.00
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the…
- CVE-2025-59954Sep 29, 2025risk 0.00cvss —epss 0.00
Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.
- CVE-2025-55007Sep 1, 2025risk 0.00cvss —epss 0.00
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response,…
- CVE-2023-35154Jun 23, 2023risk 0.00cvss —epss 0.00
Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a…
- CVE-2019-14278Sep 5, 2019risk 0.00cvss —epss 0.00
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
- CVE-2019-13349Sep 5, 2019risk 0.00cvss —epss 0.01
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.
- CVE-2019-13190Sep 5, 2019risk 0.00cvss —epss 0.00
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page.
- CVE-2019-13348Aug 28, 2019risk 0.00cvss —epss 0.01
In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases.
- CVE-2019-13189Aug 28, 2019risk 0.00cvss —epss 0.00
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.
- CVE-2018-12355Jun 13, 2018risk 0.00cvss —epss 0.00
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
- CVE-2018-12354Jun 13, 2018risk 0.00cvss —epss 0.00
Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.
- CVE-2018-12353Jun 13, 2018risk 0.00cvss —epss 0.00
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.