Advisories · Technology
budibase server.
Every CVE that names budibase server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
- budibase server
- Broken access control
- CVSS 7.0 High
Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
- budibase server
- Information disclosure
- CVSS 8.6 High
Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
- budibase server
- Privilege escalation
- CVSS 8.3 High
Budibase before 3.45.0 Information Disclosure via Chat Links
- budibase server
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
- budibase server
- Authentication bypass
- CVSS 8.9 High
Budibase before 3.45.0 SQL Injection via column-rename DDL
- budibase server
- SQL injection
- CVSS 8.7 High
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
- budibase server
- Path traversal
- CVSS 6.3 Medium
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
- budibase server
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
- budibase server
- Information disclosure
- CVSS 7.1 High
Budibase Server before 3.41.3 SSRF via Query Import
- budibase server
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Budibase before 3.41.3 Missing Authorization License Management
- budibase server
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Budibase before 3.41.3 Remote Code Execution via Plugin eval()
- budibase server
- Code injection
- CVSS 8.3 High
Budibase Server before 3.41.3 SSRF with Credential Leakage
- budibase server
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
- budibase server
- Broken access control
- CVSS 7.1 High
Budibase backend-core SSRF via incomplete default blacklist
- budibase server
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Budibase before 3.41.3 Privilege Escalation via User Update API
- budibase server
- Broken access control
- CVSS 8.6 High
Budibase before 3.41.3 Authorization Bypass via datasources/query
- budibase server
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
- budibase server
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Budibase before 3.40.0 Arbitrary File Write via Path Traversal
- budibase server
- Path traversal