Garvin Hicking

A alteração de senhas de usuários do backend através do módulo de configurações de usuário faz com que a senha em texto simples seja armazenada nos campos `uc` e `user settings` da tabela de banco de dados `be users`.

In multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.

A cross-site request forgery issue allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors.