01 Record

CVE-2026-73408

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

HighPUBLISHEDCNA: GitHub_M

Base score7.6 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

02 Description

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Published: 2026-08-13 22:04Z20 HR AGO
Last updated: 2026-08-14 18:06Z36 MIN AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 7.6)
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses: CWE-89
SSVC decision: ExploitationnoneAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: 885c626eb54d3a8cc039f2ab4070591ba4fb65ef84020bad551d48b34b76bf52

VendorProductVersionsPlatforms

Budibasebudibase< 3.39.18—