Is CVE-2026-73300 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73300?

CVE-2026-73300 has a CVSS v3 severity of CRITICAL (9.6).

Back

CVE-2026-73300

Description

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.