Yasser Ali

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `substring` parameter in the "admin.php" file.

The issue allows remote authenticated users to read or delete address data of arbitrary accounts. This can be achieved by sending a modified request to either update or remove address data.