Tooljet

Tooljet

22 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.3

CVE-2026-55412

  • EPSS 0.19%
  • Veröffentlicht 25.06.2026 16:07:13
  • Zuletzt bearbeitet 25.06.2026 19:16:42

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP request...

9.4

CVE-2026-55413

  • EPSS 0.26%
  • Veröffentlicht 25.06.2026 16:03:40
  • Zuletzt bearbeitet 25.06.2026 19:16:42

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any authenticated user with builder role (free tier) can overwrite a globally-shared marketplace pl...

5.4

CVE-2022-27979

Exploit
  • EPSS 0.48%
  • Veröffentlicht 26.04.2023 16:15:09
  • Zuletzt bearbeitet 09.07.2026 01:17:24

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.

7.5

CVE-2022-27978

Exploit
  • EPSS 1.04%
  • Veröffentlicht 26.04.2023 16:15:09
  • Zuletzt bearbeitet 09.07.2026 01:17:24

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.

6.5

CVE-2022-4111

Exploit
  • EPSS 0.75%
  • Veröffentlicht 22.11.2022 03:15:14
  • Zuletzt bearbeitet 21.11.2024 07:34:36

Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.

7.5

CVE-2022-3422

Exploit
  • EPSS 0.83%
  • Veröffentlicht 07.10.2022 11:15:09
  • Zuletzt bearbeitet 21.11.2024 07:19:28

Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass

4.9

CVE-2022-3348

Exploit
  • EPSS 0.88%
  • Veröffentlicht 28.09.2022 09:15:09
  • Zuletzt bearbeitet 21.11.2024 07:19:20

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.

8.8

CVE-2022-3019

Exploit
  • EPSS 0.73%
  • Veröffentlicht 29.08.2022 06:15:09
  • Zuletzt bearbeitet 21.11.2024 07:18:39

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a...

8.8

CVE-2022-2631

Exploit
  • EPSS 1.13%
  • Veröffentlicht 02.08.2022 17:15:10
  • Zuletzt bearbeitet 21.11.2024 07:01:24

Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.

8

CVE-2022-2037

Exploit
  • EPSS 1.1%
  • Veröffentlicht 09.06.2022 17:15:09
  • Zuletzt bearbeitet 21.11.2024 07:00:12

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.