Althaf Shajahan

Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

A Cross-Site Request Forgery (CSRF) issue exists in the `zone-include.php` script. This occurs because the application fails to verify the CSRF token during the linking and unlinking of banners or campaigns to zones. An attacker can exploit this by sending crafted GET or POST requests, enabling them to perform these administrative actions on behalf of an authenticated administrator.

Stored Cross-Site Scripting (XSS) occurs in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools. The issue arises when entity names are displayed without proper escaping during the detection of inconsistencies. This allows a stored script to be executed when an administrator utilizes these maintenance tools, although the exact execution is not fully controllable by the attacker.