Design/Logic Flaw

xFlow 5.46.11 and earlier allows remote attackers to determine the installation path of the application via the 1 action parameter to membersonly/index.cgi and 2 page parameter customerarea/index.cgi, probably due to invalid values...

CVE-2006-1850

Multiple cross-site scripting XSS vulnerabilities in xFlow 5.46.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 level, 2 position, 3 id, and 4 action parameters to membersonly/index.cgi, and the 5 page parameter to customerarea/index.cgi...