CVE-2026-112306 in NocoBase
Sumário
de MITRE • 19/10/2026
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.