Harold Rodriguez

A Stored Cross-Site Scripting (XSS) issue exists, allowing an authenticated low-privilege user to inject arbitrary Javascript into their e-mail address. This code is executed when an administrator logs in to view the admin dashboard, potentially resulting in the theft of an administrator's session cookie and session hijacking.

An Information Disclosure issue exists, where backups of sent and received faxes, along with database backups, are stored on the web server without access controls, using the current date as the filename.

A File Upload issue exists, allowing an authenticated user to bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.