CVE Browser

ToolJet before v3.16.208 Authorization Bypass via organizationId

ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db

ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export

ToolJet before v3.16.208 Cross-Workspace Authorization Bypass

ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

ToolJet before v3.16.208 Cross-Tenant Database Manipulation

ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables

ToolJet GitHub Actions comment body shell injection exposes deployment secrets

ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets

ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise

ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the…

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.

Improper Validation of Specified Quantity in Input in tooljet/tooljet

Improper Privilege Management in tooljet/tooljet

Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet

Improper Access Control in tooljet/tooljet

Improper Access Control in tooljet/tooljet

Excessive Attack Surface in tooljet/tooljet

ToolJet - HTML Injection in Invite New User

ToolJet - Token Leakage via Referer Header