CVE-2024-25937

SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.

CVE-2024-28029

Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.