SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super Newsletter module in the product_search.php components.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')