Skip to content
OpenAdvisories

Vendor

smithyhq

2 known vulnerabilities.

Products

sqladmin 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-54529

    SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

    SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_list server-side allow-…

    smithyhq sqladmin sqladmin PyPI
  • Medium 4.3
    CVE-2026-46645 Public exploit

    SQLAdmin: Authorization Bypass on `ajax_lookup`

    SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce. If a developer restricts model access by over…

    smithyhq sqladmin sqladmin PyPI