Skip to content
OpenAdvisories

Package · npm

@saltcorn/server

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-41478

    Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

    Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one …

    saltcorn saltcorn @saltcorn/server npm
  • Critical 9.6
    GHSA-cr3w-cw5w-h3fj

    Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE

    ### Summary 1. There is a reflected XSS vulnerability in the GET /admin/edit-codepage/:name route through the name parameter. This can be used to hijack the session of an admin if they click a specially crafted link. 2. Additionally, there is a Command Inject…

    @saltcorn/server npm