F0Dh1L

An issue exists in the `save maxent params()` and `load maxent params()` functions that allows for path traversal, bypassing the pathsec filesystem restriction mechanism. This occurs because the functions call Python's built-in `open()` directly. An attacker who controls the `tab dir` variable can read or overwrite model parameter files located outside the permitted data roots.

An issue exists in the Customer Import feature where insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries allow for SQL Injection. This enables authenticated attackers with the `wpamelia-manager` role to append malicious SQL queries to existing ones, potentially leading to the extraction of sensitive information from the database.