Improper neutralization of input provided by an unauthorized user into changes__reference_id parameter in URL allows for boolean-based Blind SQL Injection attacks.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.00338·Published 2025-06-05·Fixed in 7.14.3CWE-89