EUVD-2026-110521

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDa...

CVE-2026-116813

OpenPanel versions before 3.0.0 are vulnerable to a ClickHouse SQL Injection in the ConversionService.getConversion component. The root cause is the handling of unescaped event names and dates, which allows attackers to break out of string literals. Specifically, by using payloads like OR 1=1 in ...