EUVD-2022-5948

Malicious code in bioql PyPI...

EUVD-2022-27270

Malicious code in bioql PyPI...

EUVD-2022-7099

Malicious code in bioql PyPI...

EUVD-2025-7786

Malicious code in bioql PyPI...

EUVD-2022-6040

Malicious code in bioql PyPI...

EUVD-2022-6072

Malicious code in bioql PyPI...

EUVD-2024-1640

Malicious code in bioql PyPI...

EUVD-2022-34327

Malicious code in bioql PyPI...

EUVD-2023-2614

Malicious code in bioql PyPI...

EUVD-2024-1743

Malicious code in bioql PyPI...

EUVD-2024-1523

Malicious code in bioql PyPI...

nocodb (>=0.202.0 <=0.204.4), nocodb-daily (>=0.111.4-20231008-1802 <=0.204.4-pr-7795-20240305-0047) potentially affected by CVE-2025-57814 via request-filtering-agent (=1.1.2)

request-filtering-agent NPM version =1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on request-filtering-agent and may be impacted: - nocodb =0.202.0, =0.111.4-20231008-1802, =0.204.4-pr-7795-20240305-0047 Source cves: CVE-2025-57814 Source advisor...

CVE-2023-50718

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped tablename. This vulnerability may result in leakage of sensitive data in the database. Version 0.202....

CVE-2023-50717

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack...

CVE-2023-49781

NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are...

CVE-2023-5104

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0...

NocoDB Cross-Site Scripting Vulnerability (CNVD-2025-05387)

NocoDB is an open source Airtable alternative. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb to a smart spreadsheet. A cross-site scripting vulnerability exists in NocoDB versions prior to 0.258.0, which stems from the lack of effective filtering and escaping of user-supplied data...

Reflected Cross-Site Scripting (Reflected XSS)

NocoDB is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to the insecure usage of the EJS template engine, specifically the %- function in resetPassword.ts, which can directly renders unescaped user input, allowing malicious scripts to execute when processed ...

CVE-2025-27506

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

CVE-2025-27506

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...