The Acclaim block plugin prior to 2019-06-26 for Moodle allows SQL Injection via delete_records.
youracclaim acclaim