AIKIDO-2025-10880

TL;DR

Affected versions of this package are vulnerable to SQL injection. The whereIn method in Select directly interpolates user-supplied values into the SQL string, allowing malicious input to modify the query and potentially access or manipulate data. This fix replaces unsafe string concatenation with proper parameter binding by adding each value to $this->params and generating database-safe placeholders via Utilities::get_placeholder(), ensuring the WHERE IN clause is fully parameterized and protected from injection attacks.