KN
Product
KNOWAGE
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 16Low 0
Watch
Add KNOWAGE to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-59954 | 9.8 | Sep 29 | Knowage Contains a Remote Code Execution Vulnerability Affected: before 8.1.27 |
| CVE-2019-13188 | 9.8 | Sep 5 | In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application Affected: before 6.4 |
| CVE-2024-57971 | 9.1 | Feb 16 | DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name Affected: before 8.1.30 |
| CVE-2023-38702 | 8.8 | Aug 4 | Knowage is an open source analytics and business intelligence suite Affected: 6.1.0 before 8.1.8 |
| CVE-2021-30055 | 8.8 | Apr 5 | A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report Affected: before 7.4 |
| CVE-2019-13348 | 8.8 | Aug 28 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases Affected: before 6.4 |
| CVE-2025-58441 | 6.5 | Jan 7 | Knowage is vulnerable to blind server-side request forgery (SSRF) Affected: before 8.1.37 |
| CVE-2023-37472 | 6.5 | Jul 14 | Knowage is an open source suite for business analytics Affected: 6.1.0 before 8.1.8 |
| CVE-2023-36819 | 6.5 | Jul 3 | Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems Affected: 6.0.0 before 8.1.8 |
| CVE-2023-35154 | 6.5 | Jun 23 | Knowage is an open source analytics and business intelligence suite Affected: 6.1.0 before 8.1.8 |
| CVE-2022-39295 | 6.1 | Oct 13 | Improper Neutralization of Alternate XSS Syntax in Knowage-Server Affected: 6.1.0 before 7.4.22; 8.0.0 before 8.0.9 |
| CVE-2021-30213 | 6.1 | May 12 | Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS) Affected: 7.3.0 |
| CVE-2021-30058 | 6.1 | Apr 5 | Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS) Affected: before 7.4 |
| CVE-2019-13189 | 6.1 | Aug 28 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page Affected: before 6.4 |
| CVE-2018-12355 | 6.1 | Jun 13 | Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue Affected: 6.1.1 |
| CVE-2021-30214 | 5.4 | May 12 | Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter Affected: 7.3.0 |
| CVE-2021-30212 | 5.4 | May 12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS) Affected: 7.3.0 |
| CVE-2021-30211 | 5.4 | May 12 | Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS) Affected: 7.3.0 |
| CVE-2021-30056 | 5.4 | Apr 5 | Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS) Affected: before 7.4 |
| CVE-2025-55007 | 5.3 | Sep 1 | Knowage vulnerable to server-side request forgery Affected: before 8.1.37 |
| CVE-2019-13190 | 5.3 | Sep 5 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token Affected: through 6.1.1 |
| CVE-2021-30057 | 4.8 | Apr 5 | A stored HTML injection vulnerability exists in Knowage Suite version 7.1 Affected: before 7.4 |
Showing 22