CVE-2009-3781
Content management system does not check access permissions for private files, allowing others to view those files.
CVE-2008-6548
Product does not check the ACL of a page accessed using an "include" directive, allowing attackers to read unauthorized files.