ADOdb PHP's SQLite3 driver contains a critical SQL injection vulnerability due to improper escaping of query parameters in the metaColumns(), metaForeignKeys(), and metaIndexes() methods when called with crafted table names. This flaw allows an attacker to execute arbitrary SQL statements if untrusted input is passed to these methods. The vulnerability is fixed in version 5.22.10.