2025 Base44 — Critical NoSQL injection; 200+ apps exposed

2025 Unknown records affected

Data compromised

Application data; potential full access

Technical writeup

Critical NoSQL injection in Base44 (vibe coding platform, Wix acquisition). Exposed 200+ applications. After patching, admin backdoor remained open. Powers many infrastructure apps.

Root cause

NoSQL injection; admin backdoor

References

https://wiz.io/blog/critical-vulnerability-base44