Appsmith

Appsmith versions 1.95 and earlier are vulnerable to a stored XSS in the Table Widget component, allowing an authenticated attacker to perform administrative account takeover via session-based privilege escalation.

A SQL injection vulnerability exists in Appsmith's FilterDataServiceCE.java in versions 1.98 and earlier where the dropTable method constructs a SQL DROP TABLE statement using string concatenation with the table name, allowing arbitrary SQL command execution, leading to potential data loss, exfiltration, or modification.