CVE Feed

    Dashboard / CVE / CVE-2026-111613

    CVE-2026-111613

    AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.

    Published:Oct 16, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.00473
    CVSS Score:7.5

    Affected Products

    Vendor
    Alldata
    Product
    Alldata

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-19827 (CVSS 5.5) — A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the f…
    CVE-2026-19826 (CVSS 5.5) — A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.rea…
    CVE-2024-27605 (CVSS 7.5) — Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users…
    CVE-2024-29432 (CVSS 9.8) — Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/ma…
    CVE-2024-27604 (CVSS 9.8) — Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.…
    CVE-2024-29434 (CVSS 8.3) — An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traver…
    CVE-2024-27602 (CVSS 9.1) — Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have bee…
    CVE-2024-29435 (CVSS 4.1) — An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.…
    CVE-2024-29433 (CVSS 9.8) — A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitr…

    References

    https://github.com/alldatacenter/alldata
    https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java
    https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135
    https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124
    https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection
    https://www.vulncheck.com/advisories/alldata-through-0.7.1-unauthenticated-jdbc-injection-via-jobjdbcdatasource-test
    https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High