CSRF vulnerability and missing permission checks in xpath-config-viewer

xpath-config-viewer 1.1.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to create and delete XPath expressions. Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery...