An unauthenticated user can perform SQL injection via public or embedded dashboard and chart requests that utilize the `applyMysqlOrPostgresVariables` function. The issue occurs because SQL dashboard-variable substitution unsafely handles attacker-controlled JavaScript replacement strings across SQL connectors and fails to escape backslashes in quoted contexts for MySQL and MariaDB. By sending crafted URL filter values to a chart backed by a stored SQL query, an attacker can use replacement-string dollar sequences or backslash handling to alter SQL queries. This allows the attacker to read, modify, or delete data accessible to the configured database account.