In reply to Alex.

Based on our experience reviewing Patchstack’s claims, their claims of vulnerabilities and details of vulnerabilities are not always accurate. So it wouldn’t be accurate to say no investigation is needed.

The listed SQL injection vulnerabilities are from 2015 and the logging at issue was introduced in May, so there was no overlap between the two. Bringing up 8 year old vulnerabilities and not noting how long ago they were found, seems rather misleading.