BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Tue, 19 May 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unsanitized Metric Filters Enable SQL Injection in BillaBear EventRepository | |
| Weaknesses | CWE-89 |
Tue, 19 May 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-05-19T15:10:48.852Z
Reserved: 2026-03-09T00:00:00.000Z
Link: CVE-2026-31069
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-05-19T16:16:20.230
Modified: 2026-05-19T18:04:29.373
Link: CVE-2026-31069
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-19T17:00:12Z