SQL injection vulnerability in mod/gallery/ajax/gallerydata.php in AuraCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the albums parameter.
js/pages/pagesdata.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to add, edit, and delete web content via a modified id parameter.