36 matches found
CVE-2024-58394
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
EUVD-2024-55821
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
CVE-2024-58394
Retool versions before 3.88.0 are vulnerable to a cross-site scripting (XSS) flaw. An unauthenticated attacker can execute scripts in a victim's session by proxying a malicious SVG file through the /api/imageProxy endpoint. The vulnerability exists because the application serves the SVG from the ...
CVE-2024-58394 Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
CVE-2024-58394 Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
CVE-2024-58394: Improper Neutralization of Input During Web Page Generation
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
PT-2026-121354
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
VulnCheck KEV: CVE-2024-58394
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a...
Retool cross-site scripting vulnerability
Versions prior to Retool 3.88.0 contain a cross-site scripting vulnerability. This vulnerability arises when malicious SVG files are passed via the /api/imageProxy endpoint; the URL parameter allows attackers to upload such SVGs, which then execute JavaScript within the victim’s session,...
Retool Login Panel - Detect
Retool login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Retool login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Retool Login Panel - Detect', 'description': 'Retool logi...
Retool < 3.88 - SVG Cross-Site Scripting Detection
This template checks for SVG Cross-Site ScriptingXSS vulnerability via the Image Proxy URL parameter in Retool. !/usr/bin/env python3 -- coding: utf-8 -- """This template checks for SVG Cross-Site ScriptingXSS vulnerability via the Image Proxy URL parameter in Reto.""" from kittysploit import fro...
EUVD-2025-14198
Malicious code in bioql PyPI...
EUVD-2024-39424
Malicious code in bioql PyPI...
Malicious code in retool-security-install-qa (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-41601 Malicious code in retool-security-install-qa (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-42056
Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...
CVE-2025-47424
Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...
CVE-2025-47424
Retool self-hosted before 3.196.0 allows Host header injection. When the BASEDOMAIN environment variable is not set, the HTTP host header can be manipulated...
Retool security vulnerabilities
Retool is a platform from Retool, Inc. Any content can be developed using the code, design, debug, review, and deploy features. A security vulnerability exists in Retool versions prior to 3.196.0 that stems from host header injection allowed when the BASEDOMAIN environment variable is not set...