pkg:npm/payload

All known vulnerabilities

• CRITICAL9.8CVE-2022-27952Unrestricted Upload of File with Dangerous Type in Payload
  from 0, < 0.15.1
• CRITICAL9.1CVE-2026-34751Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
  from 0, < 3.79.1
• HIGH8.5CVE-2026-34747Payload has an SQL Injection via Query Handling
  from 0, < 3.79.1
• HIGH7.7Payload has Authenticated SSRF via Upload Functionality
  from 0, < 3.79.1
• HIGH7.4Hidden fields can be leaked on readable collections in Payload
  from 0, < 1.7.0
• MEDIUM6.5Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
  from 0, < 3.75.0
• MEDIUM5.4Payload has a CSRF Protection Bypass in Authentication Flow
  from 0, < 3.79.1
• MEDIUM5.4payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
  from 0, < 3.74.0
• —Payload's SQLite adapter Session Fixation vulnerability
  from 0, < 3.44.0
• —Payload does not invalidate JWTs after log out
  from 0, < 3.44.0