p PatchFirst

CVE-2026-31069

CVE-2026-31069

This page contains facts from public vulnerability sources. Check the original advisory before updating.

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.

CVSS 8.8 · High · EPSS 0.4%

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • billabear/billabear Packagist

    Versions
    • 2023.04.01
    • 2023.04.02
    • 2023.04.03
    • 2024.01.01
    • 2024.01.02
    • 2024.01.03
    • 2025.01.01
    • 2025.01.02
    • 2025.01.03
    • v1.0.0
    • v1.0.1
    • v1.0.2
    • v1.0.3
    • v1.1.0
    • v1.1.1
    • v1.1.2
    • v1.1.3
    Affected ranges
    • ECOSYSTEM: ≤ 2025.01.03

    No fix published

Original sources

Check your server →