{"uuid": "227b98aa-3bf1-4d27-85f3-29e173e0d911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-72851", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117091626314475860", "content": "Budibase server <3.40.0 hit by CRITICAL SQL injection (CVE-2026-72851) in webhook-triggered EXECUTE_QUERY. Unauthenticated attackers can run arbitrary SQL on connected datasources (e.g., Snowflake). Patch managed by vendor. https://radar.offseq.com/threat/cve-2026-72851-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-1263010eb783b278 #OffSeq #SQLi #Budibase #Infosec", "creation_timestamp": "2026-08-14T03:00:28.108697Z"}