@saltcorn/server vulnerabilities (npm)
9 vulnerabilities.
-
@saltcorn/servernpm Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) 5.1 Medium -
@saltcorn/servernpm Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) 10.0 Critical -
@saltcorn/servernpm Saltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read 8.2 High -
@saltcorn/servernpm Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE 9.6 Critical -
@saltcorn/servernpm Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page 5.1 Medium -
@saltcorn/servernpm Logged-in users with any role can delete arbitrary files in @saltcorn/server 6.5 Medium -
@saltcorn/servernpm @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings 7.3 High -
@saltcorn/servernpm @saltcorn/server arbitrary file and directory listing when accessing build mobile app results 5.5 Medium -
@saltcorn/servernpm @saltcorn/server arbitrary file zip read and download when downloading auto backups 5.0 Medium