Vendors / ToolJet Records 23 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 12
Exploited now ToolJet records in CISA KEV No ToolJet vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 72
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01028 · Published 2023-04-26 · No fix listed CWE-755
Priority HIGH 71
ToolJet is an open-source low-code platform for building internal tools.
CVSS 3.1 HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00362 · Published 2026-07-08 · Fixed in 3.20.180 CWE-78
Priority MEDIUM 62
Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0082 · Published 2022-11-22 · Fixed in v1.27.0, 1.27.0 CWE-1284
Priority MEDIUM 58
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00471 · Published 2023-04-26 · No fix listed CWE-79
Priority MEDIUM 41
ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover .
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.01308 · Published 2022-05-18 · No fix listed CWE-200
Priority MEDIUM 40
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it wo…
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00997 · Published 2022-08-29 · Fixed in 1.23.0 CWE-284
Priority MEDIUM 40
Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0119 · Published 2022-08-02 · Fixed in v1.19.0 CWE-284
Priority LOW 37
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
CVSS 3.1 HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01155 · Published 2022-06-09 · Fixed in v1.16.0 CWE-1125
Priority LOW 35
Account Takeover :: when see the info i can see the hash pass i can creaked it ...............
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0101 · Published 2022-10-07 · Fixed in v1.26.1 CWE-269
Priority LOW 27
Just like in the previous report, an attacker could steal the account of different users.
CVSS 3.1 MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.0107 · Published 2022-09-28 · Fixed in v1.26.0 CWE-200
Priority LOW 25
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitatio…
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00615 · Published 2022-05-18 · No fix listed CWE-74
Open these records in search → All records by CVSS severity
2 12 9 0 0
THREATIST.IORead the docs