CVE-2024-45856Critical· 9.0▾ MidnightMindsDB Cross-site Scripting vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.5%
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
mindsdb <= 24.9.2.1Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-45847High· 8.8MindsDB Eval Injection vulnerability
CVE-2023-49795Medium· 6.5Server-Side Request Forgery in mindsdb
CVE-2023-30620High· 7.5mindsdb arbitrary file write when extracting a remotely retrieved Tarball
CVE-2026-7711High· 7.3MindsDB has an Improper Access Control Issue
CVE-2026-27483High· 8.8MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
CVE-2026-92207High· 8.8MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability