Nocobase

Nocobase

9 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.7

CVE-2026-55410

  • EPSS 0.37%
  • Veröffentlicht 15.07.2026 20:19:54
  • Zuletzt bearbeitet 18.07.2026 02:17:10

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata....

10

CVE-2026-52887

  • EPSS 0.59%
  • Veröffentlicht 15.07.2026 20:16:43
  • Zuletzt bearbeitet 20.07.2026 16:17:05

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgR...

6.8

CVE-2026-52888

  • EPSS 0.27%
  • Veröffentlicht 15.07.2026 20:13:52
  • Zuletzt bearbeitet 16.07.2026 16:19:12

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL() function in packages/plugins/@nocobase/plugin-collect...

5.5

CVE-2026-58468

Exploit
  • EPSS 0.2%
  • Veröffentlicht 07.07.2026 19:27:58
  • Zuletzt bearbeitet 14.07.2026 23:17:31

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom...

8.8

CVE-2026-41640

Exploit
  • EPSS 1.88%
  • Veröffentlicht 07.05.2026 04:16:28
  • Zuletzt bearbeitet 12.05.2026 16:51:23

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds w...

7.2

CVE-2026-41641

Exploit
  • EPSS 1.83%
  • Veröffentlicht 07.05.2026 04:13:33
  • Zuletzt bearbeitet 07.05.2026 20:23:22

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() validation function that blocks dangerous SQL keywords (e.g., pg_read_file, LOAD_FILE, dblink) is...

6.5

CVE-2026-40346

Exploit
  • EPSS 0.38%
  • Veröffentlicht 18.04.2026 00:16:38
  • Zuletzt bearbeitet 13.05.2026 20:53:48

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.37, NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-...

6.5

CVE-2026-34825

Exploit
  • EPSS 0.41%
  • Veröffentlicht 02.04.2026 19:06:07
  • Zuletzt bearbeitet 24.07.2026 21:10:00

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() w...

9.9

CVE-2026-34156

Medienbericht Exploit
  • EPSS 36.5%
  • Veröffentlicht 31.03.2026 13:33:11
  • Zuletzt bearbeitet 24.07.2026 22:10:00

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom requ...