01 Record

CVE-2026-72853

Budibase before 3.40.0 SQL Injection via Oracle connector

HighPUBLISHEDCNA: VulnCheck

Base score8.8 CVSS v4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

02 Description

Budibase before 3.40.0 SQL Injection via Oracle connector

Published: 2026-08-13 21:54Z20 HR AGO
Last updated: 2026-08-13 21:54Z20 HR AGO
Reserved: 2026-08-10
Assigning CNA: VulnCheck
Record state: PUBLISHED
Severity: High (CVSS 8.8)
CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses: CWE-89
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: ac59fceda4459d6c1e715bb7d9bb81b6fa1d9292c893b05e569e2e7473a17e14

VendorProductVersionsPlatforms

Budibasebudibase0 to < 3.40.0—

github.comGitHub Security Advisory (GHSA-xj29-x47g-9w2c)https://github.com/Budibase/budibase/security/advisories/GHSA-xj29-x47g-9w2cvendor-advisory
www.vulncheck.comVulnCheck Advisory: Budibase before 3.40.0 SQL Injection via Oracle connectorhttps://www.vulncheck.com/advisories/budibase-before-sql-injection-via-oracle-connectorthird-party-advisory