Vulnerabilities

TI-2026-30575 CVE-2026-42259 · GHSA-f3g8-9xv5-77gv

Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)

MEDIUM 56

Saltcorn is an extensible, open source, no-code database application builder.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00339 Published 2026-05-07 Fixed in 1.4.6, 1.5.6 +1 CWE-601

TI-2026-30066 CVE-2026-41478 · GHSA-jp74-mfrx-3qvh

HIGH 76

Saltcorn is an extensible, open source, no-code database application builder.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00264 Published 2026-04-24 Fixed in 1.4.6, 1.5.6 +1 CWE-89

TI-2026-28978 CVE-2026-40163 · GHSA-32pv-mpqg-h292

HIGH 75

Saltcorn is an extensible, open source, no-code database application builder.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00339 Published 2026-04-10 Fixed in 1.4.5, 1.5.5 +1 CWE-22

TI-2024-32085 CVE-2024-47818 · GHSA-43f3-h63w-p6f6

MEDIUM 62

Saltcorn is an extensible, open source, no-code database application builder.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00783 Published 2024-10-07 Fixed in 1.0.0-beta.16 CWE-22