Skip to content
Noroxi

Appsmith records

18 published records for vendor appsmith.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 5.6%
Pre-auth RCE
1
With a fix record
44.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 22
  2. 24
  3. 25
  4. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2024-55964
    41Plan

    An issue was discovered in Appsmith before 1.52.

    CriticalCVSS 9.8WeaponizedEPSS 7%

    appsmith · appsmithMar 26, 2025

  • CVE-2026-24042
    39Monitor

    Appsmith public apps can execute unpublished actions (viewMode confusion)

    CriticalCVSS 9.8No exploitEPSS 1%

    appsmith · appsmithJan 22, 2026

  • CVE-2026-55454
    39Monitor

    Appsmith: Caddy admin API exposed without authentication

    CriticalCVSS 9.9No exploitEPSS 1%

    appsmith · appsmithJun 24, 2026

  • CVE-2026-30862
    36Monitor

    Critical Stored XSS & Privilege Escalation in Appsmith

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    appsmith · appsmithMar 10, 2026

  • CVE-2024-55963
    35Monitor

    An issue was discovered in Appsmith before 1.51.

    MediumCVSS 6.5Proof of conceptEPSS 31%

    appsmith · appsmithMar 26, 2025

  • CVE-2022-39824
    35Monitor

    Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via

    HighCVSS 8.9No exploitEPSS 1%

    appsmith · appsmithSep 4, 2022

  • CVE-2022-38298
    35Monitor

    Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming r

    HighCVSS 8.8No exploitEPSS 1%

    appsmith · appsmithSep 12, 2022

  • CVE-2026-50189
    35Monitor

    Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route

    HighCVSS 8.9No exploitEPSS 0%

    appsmith · appsmithJun 24, 2026

  • CVE-2026-22794
    35Monitor

    Account Takeover Vulnerability in Appsmith

    HighCVSS 8.8Proof of conceptEPSS 0%

    appsmith · appsmithJan 12, 2026

  • CVE-2026-34411
    27Monitor

    Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs

    MediumCVSS 6.9No exploitEPSS 0%

    appsmith · appsmithMar 27, 2026

  • CVE-2022-4096
    26Monitor

    Server-Side Request Forgery (SSRF) in appsmithorg/appsmith

    MediumCVSS 6.5Proof of conceptEPSS 2%

    appsmith · appsmithNov 21, 2022

  • CVE-2024-51408
    26Monitor

    AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadat

    MediumCVSS 6.5No exploitEPSS 0%

    appsmith · appsmithNov 4, 2024

  • CVE-2024-55965
    26Monitor

    An issue was discovered in Appsmith before 1.51.

    MediumCVSS 6.5No exploitEPSS 0%

    appsmith · appsmithMar 26, 2025

  • CVE-2026-7299
    21Monitor

    Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowin

    MediumCVSS 5.4Proof of conceptEPSS 0%

    appsmith · appsmithJun 2, 2026

  • CVE-2026-55455
    21Monitor

    Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist

    MediumCVSS 5.3No exploitEPSS 0%

    appsmith · appsmithJun 24, 2026

  • CVE-2026-49979
    20Monitor

    Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter

    MediumCVSS 5.1No exploitEPSS 0%

    appsmith · appsmithJun 24, 2026

  • CVE-2024-55604
    19Monitor

    Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

    MediumCVSS 4.8No exploitEPSS 0%

    appsmith · appsmithMar 25, 2025

  • CVE-2022-38299
    17Monitor

    An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpo

    MediumCVSS 4.3No exploitEPSS 1%

    appsmith · appsmithSep 12, 2022