The ipandlanguageredirect extension prior to 5.1.2 for TYPO3 allows SQL Injection.
ipandlanguageredirect project ipandlanguageredirect