Tooljet/Tooljet
Approved changes feed: RSS · Atom
cpe:2.3:a:tooljet:tooljet/tooljet:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tooljet (4c7717f2-38ff-55b9-8823-42b539a523f6) |
|---|---|
| Product | Tooljet/Tooljet (2e9406ea-58be-5531-8387-cb8fcbd19e4c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-4111 |
vulnerable | 2026-06-08 05:51:36.773331 |
Improper Validation of Specified Quantity in Input in tooljet/tooljet
MEDIUM (6.5)
Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.
Published: 2022-11-22T00:00:00.000Z
Updated: 2025-04-24T20:07:23.860Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3422 |
vulnerable | 2026-06-08 05:48:20.906186 |
Improper Privilege Management in tooljet/tooljet
CRITICAL (9.8)
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
Published: 2022-10-07T00:00:00.000Z
Updated: 2024-08-03T01:07:06.576Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3348 |
vulnerable | 2026-06-08 05:48:20.626969 |
Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet
MEDIUM (6.5)
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
Published: 2022-09-28T08:40:09.000Z
Updated: 2025-05-21T14:15:29.849Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3019 |
vulnerable | 2026-06-08 05:47:19.053293 |
Improper Access Control in tooljet/tooljet
HIGH (7.1)
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
Published: 2022-08-29T05:30:12.000Z
Updated: 2024-08-03T00:53:00.227Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2631 |
vulnerable | 2026-06-08 05:43:35.919679 |
Improper Access Control in tooljet/tooljet
CRITICAL (9.8)
Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.
Published: 2022-08-02T16:05:57.000Z
Updated: 2024-08-03T00:46:03.083Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2037 |
vulnerable | 2026-06-08 05:42:50.128916 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.