@saltcorn/server

npm · Package

9 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)CVE-2026-42259 · GHSA-F3G8-9XV5-77GV	@saltcorn/server	npm	Medium	Fix reported	2026-05-11
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)CVE-2026-41478 · GHSA-JP74-MFRX-3QVH	@saltcorn/server	npm	Critical	Fix reported	2026-05-05
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory readCVE-2026-40163 · GHSA-32PV-MPQG-H292	@saltcorn/server	npm	High	Fix reported	2026-04-10
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCEGHSA-CR3W-CW5W-H3FJ	@saltcorn/server	npm	Critical	Fix reported	2026-02-03
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerabilityCVE-2024-47818 · GHSA-43F3-H63W-P6F6	@saltcorn/server	npm	High	Fix reported	2024-10-08
Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs pageGHSA-PF56-H9QF-RXQ4	@saltcorn/server	npm	Medium	Fix reported	2024-10-07
@saltcorn/server arbitrary file zip read and download when downloading auto backupsGHSA-277H-PX4M-62Q8	@saltcorn/server	npm	Medium	Fix reported	2024-10-04
@saltcorn/server arbitrary file and directory listing when accessing build mobile app resultsGHSA-CFQX-F43M-VFH7	@saltcorn/server	npm	Medium	Fix reported	2024-10-04
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer stringsGHSA-78P3-FWCQ-62C2	@saltcorn/server	npm	High	Fix reported	2024-10-04