SQL Injection

drupal/core is vulnerable to SQL injection attacks. It does not escape the user input to the matchoperator parameter, allowing malicious users to inject and execute arbitrary SQL commands through it...