graphql vulnerability