Esquire

The issue allows local attackers to upload a malicious PHP script via the `Image Upload Mechanism` parameter in the change-image.php file. This enables attackers to potentially execute malicious code on the system.

The issue allows local attackers to inject arbitrary web script or HTML via the `search input field` parameter to admin search invoice page and client search invoice page. This is a Cross-Site Scripting (XSS) issue.