CVE-2019-19846

In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

CVE-2019-19845

In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.