budibase
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) | budibase | npm | High | Fix reported | |
| budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL | budibase | npm | High | Fix reported | |
| Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step | budibase | npm | Medium | Fix reported | |
| Budibase: Unrestricted Upload of File with Dangerous Type | budibase | npm | High | Fix reported | |
| Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows | budibase | npm | Medium | Fix reported | |
| Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview | budibase | npm | High | No fix reported | |
| Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) | budibase | npm | Critical | Fix reported |