In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsReferenceshttps://www.jetbrains.com/privacy-security/issues-fixed/
