Directory traversal

Directory traversal vulnerability in admin/deleteuser.php in HitHost 1.0.0 might allow remote attackers to delete directories possibly only empty directories via the $deleteuser variable. NOTE: the initial disclosure for this issue indicated that the researcher was unable to prove this issue;...

Cross site scripting

Cross-site scripting XSS vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via 1 the user parameter in deleteuser.php and 2 the hits parameter in viewuser.php...