Just to alleviate any confusion that i seen above. PHPMailer is an existing PHP Library. Cash has created a plugin out of this that helps Elgg communicate with PHPMailer without any need for manual intervention. Elgg has an internal function...

I'm reporting a SQL Injection bug for this plugin. For the raw queries being ran on index.php - there are no SQL Injection prevention techniques being used. To resolve this I have changed the raw queries to do. WHERE a1.string LIKE '%" ....