Nextcloud's Tables app contains a SQL injection vulnerability affecting versions 0.9.0 to before 0.9.7 and 1.0.0 to before 1.0.2. The vulnerability allows authenticated users with access to the Tables app to perform limited SQL injection attacks through the ORDER BY statement of queries. While limited in scope compared to typical SQL injections, attackers can extract data one bit at a time or cause database delays. The issue stems from missing input sanitization and has been patched in versions 0.9.7 and 1.0.2.