Existing sessions are not correctly invalidated when a user changes their password

CVE-2019-10641

Affected version: >=3.0.0,<3.5.39

Reported by:
FriendsOfPHP/security-advisories

Cross-site scripting (XSS) vulnerability in the system log of the back end

CVE-2018-10125

Affected version: >=3.0.0,<3.5.35

Reported by:
FriendsOfPHP/security-advisories

XSS vulnerabililty in the front end "unsubscribe" module of the newsletter extension

CVE-2018-5478

Affected version: >=3.0.0,<3.5.32

Reported by:
FriendsOfPHP/security-advisories

SQL injection vulnerabililty in the back end search filter and the front end listing module

CVE-2017-16558

Affected version: >=3.0.0,<3.5.31

Reported by:
FriendsOfPHP/security-advisories

A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter

CVE-2017-10993

Affected version: >=3.0.0,<3.5.28

Reported by:
FriendsOfPHP/security-advisories