NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

NocoDB: SQL Injection via DATEADD Formula

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+

NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection)

NocoDB is software for building databases as spreadsheets

NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path…

With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+

NocoDB: Stored Cross-Site Scripting via Row Comments

NocoDB: Hidden Column Exposure in Public Shared View Endpoints

NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints

NocoDB: Plaintext Password Comparison in Shared Views

NocoDB: Cross-Workspace Integration Use in Connection Test

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

NocoDB: Refresh Tokens Not Revoked on Password Reset

NocoDB is software for building databases as spreadsheets

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0

Allocation of Resources Without Limits or Throttling in nocodb/nocodb

NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

NocoDB: User Enumeration via Sign-In Timing

NocoDB: OAuth Authorization Code Race Condition

NocoDB: OAuth Tokens Persist Through Security Events

NocoDB: Refresh Tokens Persist Through Password Recovery

NocoDB: Missing Ownership Validation in MCP Token Operations

NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter

NocoDB is software for building databases as spreadsheets

NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources

NocoDB Password-Reset Flow users.service.ts race condition

NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags

NocoDB: Stored Cross-Site Scripting via Rich Text Cells

NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells

NocoDB: Stored Cross-Site Scripting via Comments

NocoDB: Stored Cross-Site Scripting via Rich Text Field

NocoDB: Stored Cross-Site Scripting via Formula Cell

NocoDB is software for building databases as spreadsheets

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7

NocoDB: Server-Side Request Forgery via Database Connection Host

NocoDB: SQL Injection via Column Title in Bulk GroupBy

NocoDB: Path Traversal via SQLite Source Filename

NocoDB: Plaintext Storage of Shared View Passwords

NocoDB: User Enumeration via Password Reset Endpoint

In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature

NocoDB: Reflected Cross-Site Scripting via Password Reset Token