Threats tagged 'ghsa-4m7v-v664-jv5c'

OpenPanel versions prior to 3.0.0 have an SQL injection vulnerability in the ConversionService.getConversion function. This flaw allows project-read members and share-link holders to inject arbitrary ClickHouse SQL via unescaped event names and dates. Exploitation can bypass project_id scoping by injecting conditions like OR 1=1, enabling unauthorized access to other tenants' analytics data.