CVE-2025-25226

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question ...

CVE-2025-25227

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVE-2024-40749

Improper Access Controls allows access to protected views.

CVE-2024-40748

Lack of output escaping in the id attribute of menu lists.

CVE-2024-40747

Various module chromes didn't properly process inputs, leading to XSS vectors.