| Package | Affected versions | Patched versions |
|---|---|---|
| mailtrain | ≤ 1.24.1 |
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free