ReactPress has SQL injection via dynamic column names in TypeORM query builders
ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. article.${key}). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys.