CVE-2016-20063

Name of the Vulnerable Software and Affected Versions Single Personal Message version 1.0.3

Description Authenticated users can execute arbitrary SQL queries by injecting malicious code through the message parameter. This allows attackers to access the admin interface and use crafted SQL statements to extract sensitive database information, such as user credentials and site configuration data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.