Vendor
Lotus versions through 0.10.2 contain an SQL injection vulnerability that allows authenticated organization users to inject SQL via billable metric property_name or categorical filter values.