Vendor
DataLife Engine 18.0 contains a remote SQL injection vulnerability in the search module's strip_data function, allowing unauthorized database queries via the story argument.