CVE-2025-58441

< 8.1.37

Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request

6.5MEDIUM

CVE-2025-59954

< 8.1.27

Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exect

9.8CRITICAL

CVE-2025-55007

< 8.1.37

Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side

3.5LOW

CVE-2023-38702

>= 6.1.0 and < 8.1.8

Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the

9.9CRITICAL

CVE-2023-37472

>= 6.1.0 and < 8.1.8

Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without

7.7HIGH

CVE-2023-36819

>= 6.0.0 and < 8.1.8

Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The end

6.5MEDIUM

CVE-2023-35154

>= 6.1.0 and < 8.1.8

Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an atta

7.2HIGH

CVE-2022-39295

>= 6.1.0 and < 7.4.22

Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server star

6.1MEDIUM

CVE-2021-30214

all versions

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'nam

5.4MEDIUM

CVE-2021-30213

all versions

Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web scri

6.1MEDIUM

CVE-2021-30212

all versions

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/res

5.4MEDIUM

CVE-2021-30211

all versions

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/res

5.4MEDIUM

CVE-2021-30058

< 7.4

Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowag

6.1MEDIUM

CVE-2021-30057

< 7.4

A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-serv

4.8MEDIUM

CVE-2021-30056

< 7.4

Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /re

5.4MEDIUM

CVE-2021-30055

< 7.4

A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the

8.8HIGH

CVE-2019-14278

<= 6.1.1

In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.

5.3MEDIUM

CVE-2019-13349

<= 6.1.1

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.

4.9MEDIUM

CVE-2019-13188

< 6.4

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

9.8CRITICAL

CVE-2019-13190

<= 6.1.1

In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup

5.3MEDIUM

CVE-2019-13348

< 6.4

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials

8.8HIGH

CVE-2019-13189

< 6.4

In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.

6.1MEDIUM

CVE-2018-12355

all versions

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.

6.1MEDIUM

CVE-2018-12354

all versions

Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/

8.8HIGH

CVE-2018-12353

all versions

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.

6.1MEDIUM