The vulnerability allows attackers to inject malicious SQL commands through user input fields, which leads to complete compromise of the database. It is a classic SQL injection flaw (CWE‑89) that can read, modify, delete, or create data and potentially allow further exploitation of the system.

Budibase, the open‑source low‑code platform, is affected in all releases prior to version 3.40.0, specifically the MySQL integration component configured with multipleStatements: true. Users should verify that their deployment is on an older release to assess risk.

The CVSS score of 9.6 indicates a critical level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via exposed input fields in the application, where an attacker can submit crafted data without authentication. Because the flaw enables execution of arbitrary SQL statements, the impact is broad and the exploitability is high.