SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the customfilter parameter in the bulk notification endpoints, which is passed directly to the where function as a raw SQL string. An attacker can execute arbitrary SQL commands by supplying crafted input, potentially...