An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0983.json"