GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.