Skip to content
OpenAdvisories

Vendor

directus

61 known vulnerabilities.

Products

directus 61 @directus/api 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.5
    CVE-2025-30351

    Suspended Directus user can continue to use session token to access API

    Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens be…

    directus directus directus @directus/api npm
  • Low 2.3
    CVE-2024-28238

    Session Token in URL in directus

    Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web se…

    directus directus directus npm