Banking@Home versions 2.1 and below from Craft Silicon suffer from a remote SQL injection vulnerability.