Vulnerabilidades em Budibase
91 resultadosAnálise Vexday
Budibase apresenta volume elevado de vulnerabilidades (44 CVEs), com 29 publicadas nos últimos 90 dias, indicando ritmo acelerado de descobertas. Não há exploração ativa documentada (0 KEV), mas 10 vulnerabilidades críticas foram registradas, predominantemente relacionadas a requisições HTTP não validadas (CWE-918), padrão típico de plataformas web. O risco é substancial em gravidade potencial, embora atualmente sem evidência de aproveitamento em campo.
CVE-2026-54351HIGHBudibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideEPSS 0.5%CVE-2026-73408HIGHBudibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorEPSS 0.5%CVE-2026-64657HIGHBudibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQLEPSS 0.4%CVE-2026-41428CRITICALBudibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected EndpointsEPSS 0.4%CVE-2026-73306MEDIUMBudibase: Account Enumeration via Login Lockout Response DifferentialEPSS 0.4%CVE-2026-73302CRITICALBudibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiedEPSS 0.4%CVE-2026-73307MEDIUMBudibase: SSRF via bare fetch() in uploadUrl during AI table generationEPSS 0.4%CVE-2026-100684CRITICALBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDCEPSS 0.4%CVE-2026-67311HIGHBudibase before 3.38.1 SSRF Blacklist Bypass via HTTP RedirectEPSS 0.4%CVE-2026-50137HIGHBudibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentialsEPSS 0.4%CVE-2026-73308MEDIUMBudibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other BuildersEPSS 0.4%CVE-2026-82245HIGHBudibase before 3.41.3 Missing Authorization License ManagementEPSS 0.4%CVE-2026-27702CRITICALBudibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)EPSS 0.4%CVE-2026-31818CRITICALBudibase: Server-Side Request Forgery via REST Connector with Empty Default BlacklistEPSS 0.4%CVE-2026-33226HIGHBudibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query PreviewEPSS 0.4%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.4%CVE-2026-82240HIGHBudibase before 3.41.3 Privilege Escalation via User Update APIEPSS 0.4%CVE-2026-73618HIGHBudibase Server before 3.40.0 NoSQL Injection via JSON ParameterEPSS 0.4%CVE-2026-82242HIGHBudibase before 3.41.3 Cross-Application Resource Injection via Missing AuthorizationEPSS 0.4%CVE-2026-72851CRITICALBudibase before 3.40.0 SQL Injection via Unauthenticated WebhookEPSS 0.4%