CVE-2025-27506 Scanner
CVE-2025-27506 Scanner - Cross-Site Scripting (XSS) vulnerability in NocoDB
Used 3.3k times · 3.3k assets checked · url
CVE
CVE-2025-27506
6.1
CVSSmedium
Exploitable remotely over the internet · no authentication required · user interaction needed.
Description
NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.
Attack Vector
Network
Privileges Req.
None
User Interaction
Required
nocodb
Updated Sep 26, 2026View on NVD →
S4E scanner
CVE history: nocodb
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →