Improperly validated order clauses lead to a SQL injection vulnerability in comtags.

An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability.

An improper access check allows privilege escalation through the comusers batch task.

Lack of output escaping leads to a XSS vector in the feed modules.

Lack of output escaping leads to a XSS vector in the readmore links for comcontent.

Lack of output escaping leads to a XSS vector in the content history component.

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

Lack of output escaping leads to a XSS vector in the multilingual associations component.