SQL Injection

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. Budibase: SQL Injection via `multipleStatements: true`CVE-2026-73300Budibase · CVSS 9.6 · 0.6% likely

   CWE-89

2. Budibase: Anonymous NoSQL operator injection via published-app query templatesCVE-2026-54350Budibase · CVSS 10 · 0.5% likely

   CWE-89

3. Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorCVE-2026-73408Budibase · CVSS 7.6 · 0.5% likely

   CWE-89

4. Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQLCVE-2026-64657Budibase · CVSS 8.4 · 0.4% likely

   CWE-89

5. Budibase Server before 3.40.0 NoSQL Injection via JSON ParameterCVE-2026-73618budibase · CVSS 8.3 · 0.4% likely

   CWE-943

6. Budibase before 3.40.0 SQL Injection via Unauthenticated WebhookCVE-2026-72851budibase · CVSS 10 · 0.4% likely

   CWE-89

7. Budibase before 3.40.0 NoSQL Injection via MongoDB datasourceCVE-2026-73617budibase · CVSS 7.1 · 0.3% likely

   CWE-943

8. Budibase before 3.40.0 SQL Injection via Oracle connectorCVE-2026-72853Budibase · CVSS 7.6 · 0.3% likely

   CWE-89

9. Budibase before 3.45.0 SQL Injection via column-rename DDLCVE-2026-100683budibase · CVSS 8 · 0.3% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.