Budibase CVE-2022-3225

Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal

SQL injection in Budibase's MySQL integration (all versions prior to 3.40.0) lets attackers execute arbitrary, stacked S

Authorization bypass in Budibase 3.31.4 and earlier. The authorized() middleware can be bypassed, enabling injection att

Budibase is a low code platform for creating internal tools, workflows, and admin panels. [CVSS 8.8 HIGH]

Unauthenticated user enumeration and metadata disclosure in Budibase prior to 3.39.32 exposes tenant identifiers, email

Server-Side Request Forgery (SSRF) in Budibase's REST datasource connector (versions prior to 3.33.4) allows authenticat

OAuth2 access and refresh token theft in Budibase's automation testing pipeline exposes SSO-authenticated builder creden

Path traversal in Budibase low-code platform 3.31.5 and earlier allows attackers to read arbitrary files through the app

Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaS

Account enumeration and targeted denial-of-service in Budibase prior to 3.39.25 stem from an observable response discrep

Filesystem existence and readability probing in Budibase Cloud's MongoDB integration prior to version 3.40.1 exposes an

Authentication bypass in Budibase low-code platform (versions prior to 3.35.4) allows remote unauthenticated attackers t