SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where the text parameter is not properly sanitized. Unauthenticated remote attackers can exploit this to read arbitrary database data, reset administrator passwords, and gain unauthorized access to the Admin Panel's Packages Manager. This access potentially enables remote code execution on affected systems. The vulnerability affects the activity index endpoint and allows complete compromise of SocialEngine installations.