Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')