Kohana up to and including 3.3.6 has SQL Injection when the order_by() parameter can be controlled.
kohanaframework kohana