MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')