simonw vulnerabilities

Products

• datasette 3

Latest simonw CVEs

Newest publication first

1. CVE-2025-64481 Open redirect endpoint in Datasette

   Published 2025-11-07

   Low·CVSS 2.7

   Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will r...

2. CVE-2023-40570 Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

   Published 2023-08-25

   Medium·CVSS 5.3

   Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-pas...

3. CVE-2021-32670 Reflected cross-site scripting issue in Datasette

   Published 2021-06-07

   Medium·CVSS 6.1

   Datasette is an open source multi-tool for exploring and publishing data. The ?_trace=1 debugging feature in Datasette does not correctly escape generated HTML, resulting in a reflected cross-site scripting vulnerability. This vulnerability is particularly relevant if your Datase...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.