Vendor
A SQL injection vulnerability in the jackq XCMS password recovery function allows remote attackers to execute arbitrary database queries via the email parameter.