Analysis of a Remote Code Execution vulnerability in the PHP Framework CodeIgniter

When do vendors need to report what to whom?

The c3p0 library provides many useful exploitation primitives, deserving more attention