NocoDB Security Vulnerabilities

NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb into a smart spreadsheet. A security vulnerability exists in NocoDB versions prior to 0.202.9, which stems from the presence of a stored cross-site scripting vulnerability...

NocoDB Code Issues Vulnerabilities

NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite and MariaDb into a smart spreadsheet. A security vulnerability exists in NocoDB versions 0.202.6 through prior to 0.202.10, which stems from the presence of a stored cross-site scripting vulnerability...

GHSA-H6R4-XVW6-JC5H NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

Summary A stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. Details The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink. This function...

NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

Summary A stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. Details The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink. This function...

CVE-2023-49781 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are...

CVE-2023-49781 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are...

CVE-2023-49781

NocoDB CVE-2023-49781 is a stored XSS vulnerability in the Formula.vue component used for Formula virtual cells. The issue arises because v-html renders the urls content after processing by replaceUrlsWithLink(), where URI::(XXX) is converted into an tag, while content outside the URI pattern re...

CVE-2023-49781 NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are...

GHSA-QG73-G3CF-VHHH NocoDB Allows Preview of Files with Dangerous Content

Summary --- Attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading Stored XSSCross-Site Script attack. PoC --- NocoDB was configured using the Release Binary Noco-macos-arm64, and nocodb version 0.202.9 currentl...

NocoDB Allows Preview of Files with Dangerous Content

Summary --- Attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading Stored XSSCross-Site Script attack. PoC --- NocoDB was configured using the Release Binary Noco-macos-arm64, and nocodb version 0.202.9 currentl...

CVE-2023-50718 NocoDB SQL Injection vulnerability

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped tablename. This vulnerability may result in leakage of sensitive data in the database. Version 0.202....

CVE-2023-50718 NocoDB SQL Injection vulnerability

NocoDB is software for building databases as spreadsheets. Prior to version 0.202.10, an authenticated attacker with create access could conduct a SQL Injection attack on MySQL DB using unescaped tablename. This vulnerability may result in leakage of sensitive data in the database. Version 0.202....

CVE-2023-50718

CVE-2023-50718 (NocoDB) SQL injection vulnerability exists prior to version 0.202.10 where an authenticated user with create access can exploit an unescaped table_name via VitessClient.ts to leak data from a MySQL database. Affected impact is data disclosure; no integrity/availability impact repo...

CVE-2023-50717

CVE-2023-50717 affects NocoDB. Versions 0.202.6 through

CVE-2023-50717 NocoDB Allows Preview of File with Dangerous Content

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack...

CVE-2023-50717 NocoDB Allows Preview of File with Dangerous Content

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack...

CVE-2023-50717 NocoDB Allows Preview of File with Dangerous Content

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack...

PT-2024-13958 · Nocodb · Nocodb

Name of the Vulnerable Software and Affected Versions: NocoDB versions prior to 0.202.10 Description: The issue allows an authenticated attacker with create access to conduct a SQL Injection attack on MySQL DB using an unescaped table name. This may result in leakage of sensitive data in the...

PT-2024-13799 · Nocodb · Nocodb

Name of the Vulnerable Software and Affected Versions: NocoDB versions prior to 0.202.9 Description: A stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of ur...

The vulnerability of the fileRead() function in the NocoDB database creation platform allows a attacker to gain unauthorized access to protected information.

The vulnerability of the fileRead function in the NocoDB database creation platform is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...