Simone Cecchini

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in the group/control panel/manage section. The vulnerable parameters are `firstName`, `lastName`, and `middleName`.

A SQL injection issue in the Help Desk application of Wave EMBASSY Remote Administration Server (ERAS) allows remote attackers to execute arbitrary SQL commands via the `ct100$4MainController$TextBoxSearchValue` parameter, also known as the search field.

The issue allows remote authenticated users to execute arbitrary SQL commands via the `ct100$4MainController$TextBoxSearchValue` parameter, which is the search field in the Help Desk application. This can lead to the execution of operating-system commands.