CVE-2026-73300

EUVD-2026-57394
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
9.6 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
budibasebudibase
𝑥
< 3.40.0
CNA
Common Weakness Enumeration
References
https://github.com/Budibase/budibase/releases/tag/3.40.0
https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw
https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw