Radoi-Teodor

Legacy REST methods fail to perform sufficient structural validation before appending an authenticated caller's query parameter as a SQL WHERE clause. This issue occurs at the '/service/v4 1/rest.php' endpoint and involves the `get entry list`, `get entries count`, and `query` functions. An account with list permissions on a module can bypass the `user hash` filter to retrieve password hashes and other sensitive database information, potentially allowing the use of administrative credentials to compromise the application.

Compiling maliciously crafted code using `@babel/core` can allow an attacker to read any source map from the system. This occurs when the attacker controls the input source code, can read the output source code, and knows the path of the target source map file.