Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
yoga class script project yoga class script 1.0