What’s added/changed in this version
The vulnerabilities are

Medium Risk: Forum password bypass in xmlhttp.php – reported by Devilshakerz
Low Risk: SQL Injection in Grouppromotions module (ACP) – reported by Devilshakerz
Low Risk: Possible XSS Injection in the error handler – reported by FooBar123
Low Risk: Possible XSS issues in old upgrade files – reported by FooBar123


Please note, that you do need to run the upgrade script for this version