Simo Ben Youssef

The issue allows for PHP code execution by uploading a .php file within a ZIP archive.

The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the `APPTMIN`, `APPTHR`, `APPTDA`, `APPTMO`, `APPTYR`, or `APPTPHONE` parameters in the reminders/index.php file.

The issue concerns an unrestricted file upload vulnerability. This vulnerability allows remote attackers to upload and execute arbitrary files with executable extensions.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `file` parameter. This could potentially lead to unauthorized actions on the affected system.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the `email` parameter to endpoints like "editquota.html" or "dodelpop.html", the `showtree` parameter to "diskusage.html", or the `mon`, `year`, `target`, or `domain` parameters to "stats/detailbw.html".

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `numdays` parameter in the webmailaging.cgi component.