Description
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud | — | — |
References
- https://projectblack.io/blog/appflowy-authenticated-sql-injection/ exploit third-party-advisory