XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.
xm-online xm\\^online 2 user account and authentication server 1.0.0