Peter Lapp

A potential security issue has been identified that could be exploited locally to allow escalation of privilege.

The issue allows remote attackers to bypass authentication, potentially obtaining sensitive information, modifying the application, or executing arbitrary code as root. This is achieved via a specific "AV Report Scheduler" HTTP User-Agent header.

The issue allows for arbitrary PHP code execution via magic methods in included classes, which can be exploited through PHP object injection vulnerabilities found in multiple widget files.

A persistent XSS issue exists in the login process, specifically in the User-Agent header, allowing an attacker to steal session IDs of logged-in users when an administrator views current sessions.

A vulnerability exists that allows an attacker to execute an arbitrary SQL query, potentially leading to the retrieval of database information or the reading of local system files via MySQL's LOAD FILE.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account. This occurs because the Response Body field does not properly sanitize user input, enabling an attacker to execute malicious scripts.