budibase.

Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

• budibase
• Server-side request forgery (SSRF)

Budibase before 3.40.0 Credential Exposure via STRING Fields

• budibase
• Hard-coded credentials

Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

• budibase
• CWE-640

Budibase before 3.40.0 SQL Injection via Oracle connector

• budibase
• SQL injection

Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

• budibase
• Server-side request forgery (SSRF)

Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users

• budibase
• Broken access control

Budibase: Snowflake private key returned unmasked from datasource API to BASIC users

• budibase
• Information disclosure

Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass

• budibase
• Cross-site scripting (XSS)

Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette

• budibase
• Cross-site scripting (XSS)

Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding

• budibase
• Denial of service

Budibase Universal Auth Bypass via Webhook Query Param Injection

• budibase
• Other injection

Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

• budibase
• Path traversal

Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

• budibase
• Broken access control

Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

• budibase
• CWE-602

Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role

• budibase
• Broken access control

BudiBase Server-Side Request Forgery vulnerability

• budibase
• Server-side request forgery (SSRF)