@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15991555...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.3), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0-beta.1, <=1.4.3)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15991555...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.4), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.4) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.4)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.4 Source cves: unknown CVE Source advisory: GHSA-59XV-588H-2VMM...

@saltcorn/admin-models (>=1.5.0, <=1.5.5-beta.0), @saltcorn/base-plugin (>=1.5.0, <=1.5.5-beta.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/data NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.4), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.4) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.4)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.4 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

GHSA-32PV-MPQG-H292 Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read

Summary Two unauthenticated path traversal vulnerabilities exist in Saltcorn's mobile sync endpoints. The POST /sync/offlinechanges endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with attacker-controlled JSON content anywhere on the serve...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.2), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.2) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.2)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.2 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: MEND:CVE-2026-40163...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: MEND:CVE-2026-40163...

EUVD-2023-60550

WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid'...