Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
on demand marketplace script project on demand marketplace script 1.0