İçeriğe atla
Noroxi

Budibase kayıtları

budibase üreticisine ait 25 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
1
Düzeltme kaydı olan
%72
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 22
  2. 23
  3. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

25 kayıt
  • CVE-2026-54350
    39İzleyin

    Budibase: Anonymous NoSQL operator injection via published-app query templates

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    budibase · budibase26 Haz 2026

  • CVE-2026-31818
    39İzleyin

    Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

    KritikCVSS 9,9İstismar yokEPSS %0

    budibase · budibase3 Nis 2026

  • CVE-2026-54352
    38İzleyin

    Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload

    KritikCVSS 9,6İstismar yokEPSS %0

    budibase · budibase26 Haz 2026

  • CVE-2026-54351
    38İzleyin

    Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

    KritikCVSS 9,6İstismar yokEPSS %0

    budibase · budibase26 Haz 2026

  • CVE-2026-31816
    37İzleyin

    Budibase Universal Auth Bypass via Webhook Query Param Injection

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    budibase · budibase9 Mar 2026

  • CVE-2026-35216
    36İzleyin

    Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

    KritikCVSS 9,0İstismar yokEPSS %1

    budibase · budibase3 Nis 2026

  • CVE-2026-41428
    36İzleyin

    Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

    KritikCVSS 9,1İstismar yokEPSS %0

    budibase · budibase24 Nis 2026

  • CVE-2026-27702
    36İzleyin

    Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

    KritikCVSS 9,0İstismar yokEPSS %0

    budibase · budibase25 Şub 2026

  • CVE-2026-25737
    36İzleyin

    Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

    KritikCVSS 9,0İstismar yokEPSS %0

    budibase · budibase9 Mar 2026

  • CVE-2026-35214
    34İzleyin

    Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

    YüksekCVSS 8,7İstismar yokEPSS %0

    budibase · budibase3 Nis 2026

  • CVE-2026-25041
    34İzleyin

    Budibase has a Command Injection in PostgreSQL Dump Command

    YüksekCVSS 8,6İstismar yokEPSS %0

    budibase · budibase9 Mar 2026

  • CVE-2026-25044
    34İzleyin

    Budibase: Command Injection in Bash Automation Step

    YüksekCVSS 8,7İstismar yokEPSS %0

    budibase · budibase3 Nis 2026

  • CVE-2026-35218
    34İzleyin

    Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette

    YüksekCVSS 8,7İstismar yokEPSS %0

    budibase · budibase3 Nis 2026

  • CVE-2026-33226
    34İzleyin

    Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

    YüksekCVSS 8,7İstismar yokEPSS %0

    budibase · budibase20 Mar 2026

  • CVE-2026-25045
    34İzleyin

    Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

    YüksekCVSS 8,7İstismar yokEPSS %0

    budibase · budibase9 Mar 2026

  • CVE-2026-50137
    32İzleyin

    Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credenti

    YüksekCVSS 8,2İstismar yokEPSS %0

    budibase · budibase26 Haz 2026

  • CVE-2026-42239
    32İzleyin

    Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

    YüksekCVSS 8,1İstismar yokEPSS %0

    budibase · budibase7 May 2026

  • CVE-2026-30240
    32İzleyin

    Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

    YüksekCVSS 8,1İstismar yokEPSS %0

    budibase · budibase9 Mar 2026

  • CVE-2026-25043
    30İzleyin

    Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding

    YüksekCVSS 7,5İstismar yokEPSS %0

    budibase · budibase3 Nis 2026

  • CVE-2026-50132
    29İzleyin

    Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase

    YüksekCVSS 7,3İstismar yokEPSS %0

    budibase · budibase26 Haz 2026

  • CVE-2026-54353
    28İzleyin

    Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation

    YüksekCVSS 7,1İstismar yokEPSS %0

    budibase · budibase26 Haz 2026

  • CVE-2023-29010
    26İzleyin

    BudiBase Server-Side Request Forgery vulnerability

    OrtaCVSS 6,5İstismar yokEPSS %0

    budibase · budibase6 Nis 2023

  • CVE-2022-3225
    22İzleyin

    Improper Control of Dynamically-Managed Code Resources in budibase/budibase

    OrtaCVSS 5,7İstismar yokEPSS %0

    budibase · budibase16 Eyl 2022

  • CVE-2026-25040
    22İzleyin

    Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role

    OrtaCVSS 5,7İstismar yokEPSS %0

    budibase · budibase29 Oca 2026

  • CVE-2026-50136
    21İzleyin

    Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

    OrtaCVSS 5,3İstismar yokEPSS %0

    budibase · budibase26 Haz 2026