Ranjit Pahan

The issue is related to improper access control in the reporting engine, allowing remote attackers to download PDF reports for arbitrary documents via crafted requests.

The issue is a cross-site scripting (XSS) problem in the Discuss app, allowing remote attackers to inject arbitrary web script in the browser of a victim by posting crafted contents.

A SQL injection issue allows attackers to execute arbitrary SQL commands via the `DeviceID` parameter in the "/client/api/json/v2/nfareports/compareReport" API endpoint.