Bacula-Web prior version 8.0.0 suffer several SQL injection and XSS vulnerabilities (see CVE-2017-15367 for more details).
A big thanks to Gustavo Sorondo for his help to fix those issues.
I would strongly recommend you to use at least version 8.0.0.
If you still want to take the risk, and install an older version, you can download a previous version from Github.
Release date: 22nd June 2018
Type: minor bug fix
Release notes: http://www.bacula-web.org/2018/06/22/bacula-web-8-0-1/