Search results

Database RLS — Ownership field dropdown ignores schema fields (only shows userId)

Status: Open.

#262 In geturbackend/urBackend;

· Nitin-kumar-yadav1307 opened on Jun 2, 2026

[Bug] dashboard-api: uploadFile does not sanitize file.originalname before use in storage path, allowing path injection characters

Status: Open.

#261 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] public-api: updateSingleData quota check is susceptible to TOCTOU race — concurrent updates can collectively exceed the database limit

Status: Open.

#260 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] dashboard-api: getGlobalStats opens N sequential MongoDB connections to count users — one per project

Status: Open.

#259 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] dashboard-api: INCR and EXPIRE in dbExport are not atomic — export quota key can persist without TTL if process crashes

Status: Open.

#258 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[Bug] dashboard-api: dbExport daily limit check has TOCTOU race — concurrent requests can bypass per-day export cap

Status: Open.

#255 In geturbackend/urBackend;

· anshul23102 opened on Jun 2, 2026

[UI Enhancement] Revamp Landing Page for Modern Look & Improved User Experience

GSSOC'26

Status: Open.

#251 In geturbackend/urBackend;

· Siddh2024 opened on Jun 1, 2026

[Bug] consumer export worker streams entire collection with no document count cap, enabling resource exhaustion on collections with millions of documents

Status: Open.

#249 In geturbackend/urBackend;

· anshul23102 opened on Jun 1, 2026

[Bug] public-api: rate limiter sets validate.trustProxy: false but app.set('trust proxy', 1) is not applied, causing all cloud-deployed clients to share one rate-limit bucket

Status: Open.

#248 In geturbackend/urBackend;

· anshul23102 opened on Jun 1, 2026

[Bug] dashboard-api: AI query builder accepts prompt with no max-length constraint, allowing unbounded token consumption on every AI request

Status: Open.

#247 In geturbackend/urBackend;

· anshul23102 opened on Jun 1, 2026

[Bug] dashboard-api: isSafeUri in project.controller.js does not block RFC-1918 or cloud metadata IP ranges, enabling SSRF via external MongoDB URI

Status: Open.

#245 In geturbackend/urBackend;

· anshul23102 opened on Jun 1, 2026

feat: Adding rate limit to consumer api's

GSSOC'26

level:intermediate

Status: Open.

#243 In geturbackend/urBackend;

· Ayush4958 opened on May 31, 2026