EDocmans claim

Edocman claimed to have followed Joomla's database API. However that claim was not 100% true

EDocman had a SQL injection vulnerability because some parts of the extension did not consistently use Joomla’s parameterized database API**, even though the developers** intended and claimed to follow it.