Knowagelabs
Products
2- 20 CVEs
- 11 CVEs
Recent CVEs
24| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-30055 | Hig | 0.57 | 8.8 | 0.02 | Apr 5, 2021 | A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report. | ||
| CVE-2019-13348 | Hig | 0.57 | 8.8 | 0.01 | Aug 28, 2019 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases. | ||
| CVE-2018-12354 | Hig | 0.57 | 8.8 | 0.00 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request. | ||
| CVE-2021-30213 | Med | 0.40 | 6.1 | 0.03 | May 12, 2021 | Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter. | ||
| CVE-2021-30058 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2021 | Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter. | ||
| CVE-2019-13189 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. | ||
| CVE-2018-12355 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue. | ||
| CVE-2018-12353 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2018 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue. | ||
| CVE-2021-30214 | Med | 0.37 | 5.4 | 0.24 | May 12, 2021 | Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. | ||
| CVE-2021-30212 | Med | 0.35 | 5.4 | 0.01 | May 12, 2021 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter. | ||
| CVE-2021-30211 | Med | 0.35 | 5.4 | 0.01 | May 12, 2021 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter. | ||
| CVE-2021-30056 | Med | 0.35 | 5.4 | 0.01 | Apr 5, 2021 | Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage. | ||
| CVE-2019-14278 | Med | 0.35 | 5.3 | 0.01 | Sep 5, 2019 | In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page. | ||
| CVE-2019-13190 | Med | 0.35 | 5.3 | 0.01 | Sep 5, 2019 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. | ||
| CVE-2019-13349 | Med | 0.32 | 4.9 | 0.01 | Sep 5, 2019 | In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes. | ||
| CVE-2021-30057 | Med | 0.31 | 4.8 | 0.01 | Apr 5, 2021 | A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters. | ||
| CVE-2025-58441 | 0.00 | — | 0.00 | Jan 7, 2026 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the… | |||
| CVE-2025-59954 | 0.00 | — | 0.01 | Sep 29, 2025 | Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27. | |||
| CVE-2025-55007 | 0.00 | — | 0.00 | Sep 1, 2025 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response,… | |||
| CVE-2023-38702 | 0.00 | — | 0.01 | Aug 4, 2023 | Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need… |
- risk 0.57cvss 8.8epss 0.02
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.
- risk 0.57cvss 8.8epss 0.01
In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases.
- risk 0.57cvss 8.8epss 0.00
Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.
- risk 0.40cvss 6.1epss 0.03
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.
- risk 0.40cvss 6.1epss 0.01
Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter.
- risk 0.40cvss 6.1epss 0.01
In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.
- risk 0.40cvss 6.1epss 0.01
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
- risk 0.40cvss 6.1epss 0.01
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
- risk 0.37cvss 5.4epss 0.24
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.
- risk 0.35cvss 5.4epss 0.01
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.
- risk 0.35cvss 5.4epss 0.01
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.
- risk 0.35cvss 5.4epss 0.01
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
- risk 0.35cvss 5.3epss 0.01
In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.
- risk 0.35cvss 5.3epss 0.01
In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page.
- risk 0.32cvss 4.9epss 0.01
In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.
- risk 0.31cvss 4.8epss 0.01
A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters.
- CVE-2025-58441Jan 7, 2026risk 0.00cvss —epss 0.00
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the…
- CVE-2025-59954Sep 29, 2025risk 0.00cvss —epss 0.01
Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe org.apache.commons.jxpath.JXPathContext in MetaService.java service. This issue is fixed in version 8.1.27.
- CVE-2025-55007Sep 1, 2025risk 0.00cvss —epss 0.00
Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response,…
- CVE-2023-38702Aug 4, 2023risk 0.00cvss —epss 0.01
Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need…