CRITICAL 9.6 NVD
CVE-2026-73300
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling
Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
References
- https://github.com/Budibase/budibase/releases/tag/3.40.0
- https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw
- https://github.com/Budibase/budibase/security/advisories/GHSA-q6x4-v3qx-85qw
This critical severity vulnerability with a CVSS score of 9.6 was published on 2026-08-12 via NVD.
Risk Timeline
CVE Disclosed2026-08-12 · -1 days ago
Remediation Resources
vulnfeed aggregates 10542 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.