The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the `email` parameter to endpoints like "editquota.html" or "dodelpop.html", the `showtree` parameter to "diskusage.html", or the `mon`, `year`, `target`, or `domain` parameters to "stats/detailbw.html".