An issue has been discovered in the classes QueryGenerator and QueryView, which are vulnerable to insecure deserialization. There are two exploitable scenarios: one requires the system extension ext:lowlevel (Backend Module: DB Check) to be installed, with a valid backend user having administrator privileges, and the other requires the system extension ext:sys action to be installed, with a valid backend user having limited privileges.