Questions regarding old CVEs

[rgson]

Hi,

I'm wondering about the following CVEs. I've been unable to find acknowledgement or fixes for them. Are they fixed, deemed irrelevant, or remaining?

1. CVE-2021-37298 Deserialization vulnerability since 5.1.
2. CVE-2019-9081 Deserialization vulnerability since 5.7.
3. CVE-2018-6330 SQL injection since 5.4.
4. CVE-2017-16894 Sensitive information disclosure since 5.5.

At least CVE-2018-6330 seems misdirected ("save.php" and dhx_user/dhx_version are not parts of Laravel, as far as I know).

The Laravel-related aspects of the others seem to remain, but are possibly in a gray-zone in terms of scope or responsibility.