RCE Security, which found and reported the issue, said in its report on June 30 that once Lua code is injected into a session ...