SQL Injection in Password Reset: Full Database, One Email

A ukey token in a forgot-password email handed me full read access to every record in their database. Reported in early 2025. Still live.