A SQL injection vulnerability in Nextcloud's Tables app allows authenticated attackers to execute arbitrary SQL queries up to 20 bytes long through stored injection. The vulnerability affects multiple version ranges from 0.7.0 to 1.0.4 across different branches. Attackers can extract database information or modify data by crafting input that breaks out of length limitations. The issue has been patched in versions 0.7.7, 0.8.10, 0.9.8, 1.0.4, and 2.0.0.