Cfreer

The issue concerns SQL injection vulnerabilities in the inc/lib/User.class.php file. Remote attackers can execute arbitrary SQL commands via the `email` parameter or the `userid` parameter to the "register.php" endpoint.

A cross-site scripting (XSS) issue exists in the login module, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecified vectors.