exploitDog

CVE-2026-28399

Опубликовано: 02 мар. 2026

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.

Ссылки

https://github.com/nocodb/nocodb/releases/tag/0.301.3
Product
Release Notes
https://github.com/nocodb/nocodb/security/advisories/GHSA-45rp-9p97-h852
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*

Версия до 0.301.3 (исключая)

EPSS

Процентиль: 24%

0.00319

Низкий

8.8 High

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-45rp-9p97-h852

github

6 месяцев назад

NocoDB Vulnerable to SQL Injection via DATEADD Formula

EPSS

Процентиль: 24%

0.00319

Низкий

8.8 High

CVSS3

Дефекты

CWE-89