Skip to content
OpenAdvisories

Vendor

saltcorn

4 known vulnerabilities.

Products

saltcorn 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-41478

    Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

    Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one …

    saltcorn saltcorn @saltcorn/server npm