CVE-2019-14228

Xavier PHP Management Panel 3.0 is affected by a Reflected POST-based XSS in the username parameter during new user registration via admin/includes/adminprocess.php. The XSS reflects on the error page when registration fails, and the vulnerability is exacerbated by the absence of CSRF protection ...

CVE-2017-15949

CVE-2017-15949 affects Xavier PHP Management Panel 2.4. The vulnerability is an SQL injection in the admin/adminuseredit.php endpoint (parameter: usertoedit) and in admin/editgroup.php (parameter: log_id). Exploitation could allow an attacker to inject SQL commands and potentially take control of...