CVE-2010-1520: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in logout.php in TaskFreak! Original multi user before 0.6.4 allows remote attackers to inject arbitrary web script or HTML via the tznMessage parameter...

CVE-2010-1521: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in include/classes/tznuser.php in TaskFreak! Original multi user before 0.6.4 allows remote attackers to execute arbitrary SQL commands via the password parameter to login.php...