VYPR

Nocodb

by Nocodb

npm: nocodb

Source repositories

CVEs (59)

  • CVE-2026-47387HigJun 23, 2026
    risk 0.55cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check that does not…

  • CVE-2026-24769CriJan 28, 2026
    risk 0.52cvss 9.0epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are…

  • CVE-2026-28399HigMar 2, 2026
    risk 0.50cvss 8.8epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.

  • CVE-2022-2064HigJun 13, 2022
    risk 0.50cvss 8.8epss 0.01

    Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.

  • CVE-2022-2063HigJun 13, 2022
    risk 0.50cvss 8.8epss 0.01

    Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.

  • CVE-2023-35843HigJun 19, 2023
    risk 0.49cvss 7.5epss 0.09

    NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to access sensitive files…

  • CVE-2026-47383HigJun 23, 2026
    risk 0.48cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths persisted the raw…

  • CVE-2026-53931MedJun 23, 2026
    risk 0.45cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the…

  • CVE-2023-50718MedMay 14, 2024
    risk 0.42cvss 6.5epss 0.01

    NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped `table_name`. This vulnerability may result in leakage of sensitive data in the…

  • CVE-2023-43794MedOct 17, 2023
    risk 0.42cvss 6.5epss 0.01

    Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can…

  • CVE-2022-2062HigJun 13, 2022
    risk 0.42cvss 7.5epss 0.01

    Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.

  • CVE-2022-3423HigOct 7, 2022
    risk 0.41cvss 7.3epss 0.02

    Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.

  • CVE-2023-49781HigMay 14, 2024
    risk 0.40cvss 7.3epss 0.01

    NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls"…

  • CVE-2026-47375MedJun 23, 2026
    risk 0.39cvss 6.0epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). The value is…

  • CVE-2026-47381MedJun 23, 2026
    risk 0.38cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's…

  • CVE-2026-47379MedJun 23, 2026
    risk 0.38cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for legacy plaintext passwords, leaking the password's length and per-character prefix through response timing. This…

  • CVE-2026-47378MedJun 23, 2026
    risk 0.38cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort…

  • CVE-2026-47279MedJun 23, 2026
    risk 0.38cvss epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from…

  • CVE-2023-50717MedMay 14, 2024
    risk 0.37cvss 5.7epss 0.01

    NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site…

  • CVE-2026-46551MedJun 23, 2026
    risk 0.35cvss 6.5epss 0.00

    NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could…

Page 1 of 3