Saltcorn vulnerabilities
We track 2 vulnerabilities in Saltcorn products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 24, 2026.
2vulnerabilities
1critical
1high
0exploited
9.1average CVSS score
Latest Saltcorn vulnerabilities
- 9.9 Critical severity
saltcorn: Improper Neutralization of Special Elements used in an SQL Command
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one t
- 8.2 High severity
saltcorn: Improper Limitation of a Pathname to a Restricted Directory
Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.json file with