Read the docs

Budibase

Records91All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical19CVSS 9.0–10.0
CVSS high57CVSS 7.0–8.9

Exploited now

Budibase records in CISA KEV

No Budibase vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Budibase 25 records HIGH

Records

91 records

TI-2026-51076 CVE-2026-72851 · GHSA-x389-5jg5-q6vh

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

Priority HIGH 80

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.00356 Published 2026-08-13 Fixed in 3.40.0 CWE-89
TI-2026-56709 CVE-2026-82244 · GHSA-8j7v-pg7g-633j

Budibase before 3.41.3 Remote Code Execution via Plugin eval()

Priority HIGH 76

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00886 Published 2026-08-28 Fixed in 3.41.3 CWE-94
TI-2026-51075 CVE-2026-72850 · GHSA-ccjw-whgg-h4gh

Budibase before 3.40.0 Arbitrary File Write via Path Traversal

Priority HIGH 76

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00518 Published 2026-08-13 Fixed in 3.40.0 CWE-22
TI-2026-64839 CVE-2026-100683 · GHSA-8mm2-5qwq-x6xp

Budibase before 3.45.0 SQL Injection via column-rename DDL

Priority HIGH 74

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a…

CVSS 4.0HIGH 8.9 Network Low privileges User interaction EPSS 0.00263 Published 2026-09-26 Fixed in 3.45.0 CWE-89
TI-2026-64838 CVE-2026-100682 · GHSA-xphc-jppf-jrhm

Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Priority HIGH 73

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00724 Published 2026-09-26 Fixed in 3.45.0 CWE-22
TI-2026-51702 CVE-2026-73618 · GHSA-wg7g-xr7v-hf69

Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

Priority HIGH 73

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00362 Published 2026-08-13 Fixed in 3.40.0 CWE-943
TI-2026-51078 CVE-2026-72853 · GHSA-mv4c-5rgh-72q9

Budibase before 3.40.0 SQL Injection via Oracle connector

Priority HIGH 73

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers.

CVSS 4.0HIGH 8.8 Network High privileges User interaction EPSS 0.00343 Published 2026-08-13 Fixed in 3.40.0 CWE-89
TI-2026-33456 CVE-2026-45717 · GHSA-44m2-crh7-f4q2

Missing authorization in budibase

Priority HIGH 73

Budibase is an open-source low-code platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00251 Published 2026-05-27 Fixed in 3.38.1 CWE-862
Load more
Open these records in search →