CVE-2026-72853 — Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attacke…
Published: 2026-08-13 · CVSS: 8.8 · CVSS 4.0
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7