Muztahidultanim

A stored cross-site scripting issue exists in a public portal form that allows unauthenticated submissions. The system stores content without sufficient neutralization, allowing unauthenticated attackers to submit crafted markup. This markup executes within the browser sessions of staff members who review the stored record.

Missing input validation in certain endpoints allows authenticated remote attackers to perform SQL injection. By sending specially crafted requests, an attacker can manipulate database queries to extract sensitive information from the database. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution.