projeqtor up to 11.2.0 exists to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.