NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · DAILY
Link copied RSS

2026-09-20 Daily Security Intelligence

3 itemsTop severity 9.9 (Critical)CSSA 1 · CVE 2 · Poisoning 0

CSSA Exclusive Early Warning 1

CSSA Exclusive Early Warning 8.1 High

DataEase SQL injection and SSRF vulnerabilities create server file-read and intranet-probing risk

An attacker can use the /de2api/datasetData/previewSql endpoint to execute malicious Base64-encoded SQL statements, then combine the H2 engine FILE_READ function to bypass path filtering and read arbitrary local files on the server, or obtain sensitive information through insufficiently authenticated interfaces. In addition, JDBC parameters in data-source configuration lack sanitization and can lead to connection-string injection; together with remote file-loading, this forms SSRF, allowing outbound requests toward intranet services or cloud metadata interfaces and thereby leaking internal network topology and credentials.

Component
DataEase is an open-source self-service data analytics platform. Its core architecture is based on an embedded H2 database and multi-source data connectors, aiming to deliver data integration, cleansing, and presentation through a visual interface. The system supports Excel, MySQL, and other data sources, and provides dataset preview, data-source management, and a template marketplace through a RESTful API. It is mainly deployed inside enterprises or teams to improve data-insight efficiency.
Type
SQL Injection (CWE-89)
Repo
github.com/dataease/dataease · Stars 24430
Remediation
  • Implement a strict SQL-statement allowlist and forbid execution of non-query dangerous functions. Validate protocols for all external URL requests and block access to private address ranges. In data-source configuration, strictly escape or filter special characters so that input data remains legitimate and safe.

CVE Intelligence 2

CVE-2026-93742 CVSS 9.9 Critical September 19, 2026

Totolink A3002MU formWsc command injection leading to remote code execution

In Totolink A3002MU firmware version Hh-B20211125.1046, the formWsc function in the /boafrm/formWsc file has a security defect. Improper handling of the localPin parameter leads to a command-injection (CWE-74) vulnerability. An attacker can launch the attack remotely and use this vulnerability to execute arbitrary system commands on the target device. Exploit code has been publicly disclosed and may be used in automated attacks. The vulnerability affects all Totolink A3002MU devices running the affected firmware version. An attacker needs no user interaction and can trigger the vulnerability remotely over the network, thereby fully controlling the device.

Component
Totolink A3002MU is a wireless network router that provides Wi-Fi connectivity and network-management functions.
Risks
  • Complete system control: An attacker can use this vulnerability to execute arbitrary commands on the router and obtain full control of the device
  • Remote no-interaction attack: An attacker can launch the attack directly over the network, with no additional action required from the victim
  • Data disclosure and tampering: An attacker can read, modify, or delete device configuration and network-traffic data
Source
NVD · CVE-2026-93742
Remediation
  • Deploy a firewall at the network boundary and restrict unauthorized access to the router management interface
  • Monitor network traffic and detect anomalous requests targeting the /boafrm/formWsc endpoint
CVE-2026-93985 CVSS 9.9 Critical September 19, 2026

OpenPanel js-runtime sandbox-escape vulnerability leading to remote code execution

Before OpenPanel js-runtime commit bad75bdd, its JavaScript webhook template validator failed to block constructor-chain access through computed member access, creating a sandbox-escape (CWE-94) security defect. An attacker with project write permission can use computed-property notation to reach the Function constructor and execute arbitrary code in the worker process. The vulnerability affects all OpenPanel users who have not updated to a fixed version. The attacker needs project write permission and can trigger the vulnerability by constructing a malicious webhook template, leading to remote code execution.

Component
OpenPanel is an open-source product analytics platform; js-runtime is its core component for handling JavaScript logic and webhook templates.
Risks
  • From ordinary user to administrator: If the victim runs OpenPanel with administrator privileges, the attacker can obtain the same privileges
  • Complete system control: An attacker can use this vulnerability to execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
  • Sandbox-escape attack: By constructing a special computed-property access chain, an attacker can break JavaScript sandbox restrictions and execute system commands directly in the worker process
Source
NVD · CVE-2026-93985
Remediation
  • Strictly restrict project write permission and authorize only trusted personnel
  • Monitor anomalous code-execution behavior in the worker process
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →