Build App Online

Build App Online has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 4 are fixed and 5 remain unpatched as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 3 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (22%). Other recurring categories include Missing Authorization, PHP Remote File Inclusion.

4 of the records (44%) have a vendor fix, while 5 remain unpatched. The oldest unresolved one dates back to 2024.

9 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage44%

Open

Fixed

Get automatic notifications for all Build App Online vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2025-32577

Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

9 records


2026-03-20 15:10	Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action Build App Online <= 1.0.23	`CVE-2026-3651`	5.3 Medium	Ronnachai Sretawat Na Ayutaya (Simonhaskelly)	No
2025-08-14 00:00	Build App Online <= 1.0.23 - Cross-Site Request Forgery Build App Online <= 1.0.23	`CVE-2025-53249`	4.3 Medium	theviper17y	No
2025-04-09 00:00	Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion Build App Online <= 1.0.23	`CVE-2025-32577`	9.8 Critical	LVT-tholv2k	No
2025-01-06 00:00	Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion Build App Online <= 1.0.23	`CVE-2024-49649`	8.1 High	Dimas Maulana	No
2024-11-28 00:00	Build App Online <= 1.0.22 - Cross-Site Request Forgery Build App Online <= 1.0.22	`CVE-2024-53751`	4.3 Medium	ardias	No
2023-12-27 00:00	Build App Online <= 1.0.21 - Authentication Bypass via Header Build App Online <= 1.0.21	`CVE-2023-51478`	9.8 Critical	István Márton	Yes
2023-12-27 00:00	Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update Build App Online <= 1.0.20	`CVE-2023-51479`	8.8 High	Rafie Muhammad	Yes
2023-12-27 00:00	Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism Build App Online <= 1.0.22	`CVE-2023-7264`	8.1 High	Ram	Yes
2022-12-06 00:00	Build App Online <= 1.0.18 - Unauthenticated SQL Injection Build App Online <= 1.0.18	`CVE-2022-3241`	9.8 Critical	Donato Di Pasquale	Yes

Showing 1–9 of 9 reports