Vulnerabilidades em budibase
81 resultadosAnálise Vexday
Budibase apresenta footprint de risco mínimo com apenas 1 CVE registrado na base, sem incidentes sob ataque ativo ou vulnerabilidades críticas. A fraqueza identificada (CWE-913 - Improper Control of Dynamically-Managed Code Execution) é de severidade moderada e não há registros recentes de novas exposições, indicando perfil de risco baixo no curto prazo.
CVE-2026-46425CRITICALBudibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant usersEPSS 0.3%CVE-2026-72851CRITICALBudibase before 3.40.0 SQL Injection via Unauthenticated WebhookEPSS 0.3%CVE-2026-42239HIGHBudibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverEPSS 0.3%CVE-2026-82245HIGHBudibase before 3.41.3 Missing Authorization License ManagementEPSS 0.3%CVE-2026-82239HIGHBudibase before 3.41.3 Authorization Bypass via datasources/queryEPSS 0.3%CVE-2026-72855HIGHBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTEPSS 0.3%CVE-2026-35219HIGHBudibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP BlacklistEPSS 0.3%CVE-2026-30240CRITICALBudibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment SecretsEPSS 0.3%CVE-2026-25737HIGHBudibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)EPSS 0.3%CVE-2026-45061HIGHBudibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)EPSS 0.3%CVE-2026-45719MEDIUMBudibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views APIEPSS 0.3%CVE-2026-45716HIGHBudibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP ConfigurationEPSS 0.3%CVE-2026-72857HIGHBudibase before 3.40.0 Credential Exposure via STRING FieldsEPSS 0.3%CVE-2026-82240HIGHBudibase before 3.41.3 Privilege Escalation via User Update APIEPSS 0.3%CVE-2026-45715HIGHBudibase: SSRF Bypass via HTTP Redirect in REST Datasource IntegrationEPSS 0.3%CVE-2026-45548HIGHBudibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist ValidationEPSS 0.3%CVE-2026-48152HIGHBudibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLEPSS 0.3%CVE-2026-45717HIGHBudibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL.EPSS 0.3%CVE-2026-72853HIGHBudibase before 3.40.0 SQL Injection via Oracle connectorEPSS 0.2%CVE-2026-54356HIGHBudibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`EPSS 0.2%