Simon Uvarov

The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session.

The issue allows a privileged user to gain access to the server via crafted HTTP requests, exploiting an unrestricted file upload vulnerability with remote code execution in the ocsreports component.

The issue involves multiple Cross-Site Scripting vulnerabilities.

The issue is related to the lack of an anti-CSRF protection mechanism. This allows an attacker to modify sensitive information such as API tokens and passwords.

The issue allows an attacker to traverse the file system to unintended locations and/or access arbitrary files due to a lack of appropriate validation when performing actions on files. This is related to a directory traversal issue in the `/media/api` endpoint.

The issue allows an attacker to traverse directories by manipulating the pathname constructed from external input in the `/filemanager/ajax calls.php` file. This is due to the failure to properly neutralize sequences such as `..` that can resolve to a location outside the intended directory.

The issue concerns a directory traversal problem. It arises from the improper validation of file paths in archives by the `/filemanager/ajax calls.php` endpoint. This allows attackers to craft archives that, when extracted, can overwrite arbitrary files on the system via an extract action.

The issue allows a privileged user to gain access to the server via a template file containing PHP code. This is due to unrestricted file upload in the require/mail/NotificationMail.php file in Webconsole, where file extensions other than .html are permitted.