DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface.
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')