high7.6
CVE-2026-72853
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in id…
Impact
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.
Affected products
| Product | Affected versions |
|---|---|
| Budibase | before 3.40.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.