Yaroslav Babin

An issue was discovered that allows CSRF in the htdocs/manage/users.php file, enabling the creation of another user with admin privileges.

An issue was discovered in the software, where the `htdocs/ajax/update.php` endpoint has a cross-site scripting (XSS) vulnerability via the `field name` parameter.

An issue was discovered in the htdocs/switch.php file, where there is a cross-site scripting (XSS) vulnerability via the `current page` parameter. This allows for potential malicious script execution.

An issue was discovered in the software, where the `/htdocs/popup.php` endpoint has a cross-site scripting (XSS) vulnerability via the `cat` parameter. This allows for potential malicious script execution.

An issue was discovered in the software, where the /htdocs/list.php endpoint has a cross-site scripting (XSS) issue via the `show notification list issues` or `show authorized issues` parameters.

An issue was discovered in the software, where the `/htdocs/validate.php` endpoint has a cross-site scripting (XSS) vulnerability via the `values` parameter.

An issue was discovered in the software, where the /htdocs/switch.php file has an Open Redirect via the `current page` parameter.

An issue was discovered in the software, where the /htdocs/post note.php endpoint has a cross-site scripting (XSS) issue via the `garlic prefix` parameter.