TAKING OVER 60K SPYWARE USER ACCOUNTS WITH SQL INJECTION

Summary from the TLDR Web Dev newsletter

This developer discovered a SQL injection vulnerability in the Catwatchful stalkerware service that allowed him to access its database. He successfully dumped the 'user' table, gaining access to over 60,000 plaintext usernames and passwords.