I just remembered that I reported an SQL injection vulnerability to LNbits on March 2022 and they did not release a fix until February 2023.