Priority HIGH 76
Appsmith is a platform to build admin panels, internal tools, and dashboards.
appsmithorg
Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
appsmithorg records in CISA KEVNo appsmithorg vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
18 records in Appsmith · all components
TI-2026-18312 CVE-2026-22794
Account Takeover Vulnerability in Appsmith
Priority HIGH 76
Appsmith is a platform to build admin panels, internal tools, and dashboards.
TI-2026-36948 CVE-2026-50189
Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
Priority HIGH 74
Appsmith is a platform to build admin panels, internal tools, and dashboards.
Priority HIGH 74
Appsmith is a platform to build admin panels, internal tools, and dashboards.
TI-2024-34357 CVE-2024-51408 · GHSA-94hw-32gv-86pf
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json…
Priority HIGH 72
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.
TI-2022-03744 CVE-2022-4096 · GHSA-cq38-9f6p-96j8
Server-Side Request Forgery (SSRF) in appsmithorg/appsmith
Priority MEDIUM 62
Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.
TI-2026-06406 CVE-2026-7299 · GHSA-6j63-xfwq-f8vj
Cross-site scripting in appsmithorg Appsmith
Priority MEDIUM 61
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or co…
Priority MEDIUM 58
An issue was discovered in Appsmith before 1.52.
TI-2026-40019 CVE-2026-55455
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
Priority MEDIUM 57
Appsmith is a platform to build admin panels, internal tools, and dashboards.
Priority MEDIUM 54
An issue was discovered in Appsmith before 1.51.
TI-2026-19370 CVE-2026-24042
Appsmith public apps can execute unpublished actions (viewMode confusion)
Priority MEDIUM 50
Appsmith is a platform to build admin panels, internal tools, and dashboards.
TI-2022-18822 CVE-2022-39824 · GHSA-grcg-mvxj-m89r
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to…
Priority MEDIUM 41
Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via the currentItem property of the list widget, e.g., to perform DoS attacks or ac…
TI-2022-17956 CVE-2022-38298 · GHSA-8fww-hhqw-438g
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated…
Priority LOW 39
Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.
TI-2026-26693 CVE-2026-34411 · GHSA-hvm5-gpg2-9x56
Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs
Priority LOW 37
Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication.
TI-2024-37003 CVE-2024-55965 · GHSA-c77w-wgvp-cx35
An issue was discovered in Appsmith before 1.51.
Priority LOW 29
An issue was discovered in Appsmith before 1.51.
TI-2026-36812 CVE-2026-49979
Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
Priority LOW 23
Appsmith is a platform to build admin panels, internal tools, and dashboards.
TI-2024-36913 CVE-2024-55604
Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources
Priority LOW 22
Appsmith is a platform to build admin panels, internal tools, and dashboards.
TI-2022-17957 CVE-2022-38299 · GHSA-v6wm-h278-4mr8
An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect…
Priority LOW 21
An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.