GHSA-XP6R-8PCC-XV5P BillaBear is Vulnerable to SQL Injection in the EventRepository

BillaBear all versions prior to Jan 2026 contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf without proper sanitization or identifier quoting. Although...

CVE-2026-31069

BillaBear (all versions prior to January 2026 ) is vulnerable to a SQL Injection in the EventRepository component. The root cause is the direct interpolation of user-controlled input from metric filter names and aggregation properties into SQL queries using the sprintf() function without proper s...