Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

12 records

Vendor: nocobase Clear all filters
TI-2026-76500 CVE-2026-112306 · GHSA-j67h-xf8r-r323

SQL injection in NocoBase plugin-collection-sql via setFields

Priority LOW 39

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00311 Published 2026-10-19 No fix listed CWE-89
TI-2026-58229 CVE-2026-84701 · GHSA-9mv7-8vhm-9hc5

NocoBase Rich Text Field Stored Cross-Site Scripting via API

Priority LOW 23

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00298 Published 2026-09-02 No fix listed CWE-79
TI-2026-39980 CVE-2026-55410 · GHSA-p853-83gj-wjj3

NocoBase backup restore schema name allows command injection

Priority MEDIUM 63

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00721 Published 2026-07-15 Fixed in 2.1.19 CWE-78
TI-2026-37984 CVE-2026-52888 · GHSA-v8vm-cqh8-q87q

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Priority MEDIUM 63

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00469 Published 2026-07-15 Fixed in 2.1.0-alpha.46, 2.0.62 +1 CWE-184
TI-2026-42072 CVE-2026-58468 · GHSA-mcxg-3vgg-9774

NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper

Priority MEDIUM 56

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00337 Published 2026-07-07 No fix listed CWE-918