Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 54
Reset filtersNocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
NocoDB Vulnerable to Stored Cross-site Scripting via Comments
NocoDB Vulnerable to SQL Injection via DATEADD Formula
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
NocoDB Missing Ownership Validation in MCP Token Operations
NocoDB's Refresh Tokens Not Revoked on Password Reset
NocoDB has Plaintext Storage of Shared View Passwords
NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
NocoDB Vulnerable to User Enumeration via Password Reset Endpoint
NocoDB has Stored Cross-site Scripting via Formula Cell
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue
NocoDB SQL Injection vulnerability
NocoDB Allows Preview of Files with Dangerous Content
nocodb SQL Injection vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.