{"metadata": {"vulnerability": "CVE-2026-104143", "count": 11, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-01T18:47:30.995Z", "date_only": false, "value": "2026-10-01T18:47:30.995Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104143", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T18:43:34.275Z", "date_only": false, "value": "2026-10-14T18:43:34.275Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104143", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:43:34.275Z", "date_only": false, "value": "2026-10-14T18:43:34.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-104143", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:08.347Z", "date_only": false, "value": "2026-10-14T19:17:08.347", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104143", "record": "FKIE_CVE-2026-104143", "field": "published"}, {"timestamp": "2026-10-14T23:49:56.493Z", "date_only": false, "value": "2026-10-14T23:49:56.493711Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441940355831781", "record": "CVE-2026-104143", "field": "creation_timestamp", "uuid": "932c9584-92da-4d04-8891-ca6fd505c404", "content": "CVE-2026-104143 DataEase: Stored SQL Injection via dateFormat field templates DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104143https://github.com/dataease/dataease/security/advisories/GHSA-h32f-m89w-g35fhttps://github.com/dataease/dataease/commit/c8cde16056a9e46aa4866ded94db2b250758b337https://github.com/dataease/dataease/releases/tag/v2.10.26#dataease#CVE_2026_104143#bot", "url": "https://infosec.exchange/users/cve/statuses/117441940355831781"}, {"timestamp": "2026-10-15T11:50:05.013Z", "date_only": false, "value": "2026-10-15T11:50:05.013085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxvymzoftj2l", "record": "CVE-2026-104143", "field": "creation_timestamp", "uuid": "eb689b52-9892-4bc8-b0b1-e0ddb34d95ae", "content": "CVE-2026-104143 - dataease\nIf users can log into DataEase before version 2.10.26, they can save a specially crafted date format that later changes the database queries the system runs. This can let an attacker read,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#dataease #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxvymzoftj2l"}, {"timestamp": "2026-10-15T13:53:21.313Z", "date_only": false, "value": "2026-10-15T13:53:21.313179Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104143", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T13:53:21.313Z", "date_only": false, "value": "2026-10-15T13:53:21.313179Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104143", "record": "FKIE_CVE-2026-104143", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T15:06:18.660Z", "date_only": false, "value": "2026-10-15T15:06:18.660Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104143", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T15:06:18.660Z", "date_only": false, "value": "2026-10-15T15:06:18.660Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104143", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:17:33.570Z", "date_only": false, "value": "2026-10-15T16:17:33.570", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104143", "record": "FKIE_CVE-2026-104143", "field": "lastModified"}]}