MPG < 4.2.3 - Editor+ SQLi via Project Import

Description

The plugin does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.