Vendor
BuddyPress versions from n/a through 14.5.2 contain a blind SQL injection vulnerability due to improper neutralization of special elements used in an SQL command.