Maciej Kazulak

SQL injection in ReturnUserUnitsXML.pl via the UserID parameter

SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter

Excessive permissions on configuration files containing database logins and passwords

Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key

Missing authentication in API returning request logs containing session IDs

Missing authentication in APIs returning statistical data along with session IDs

Unauthenticated access to module configuration endpoint

Conditional RCE via the "system" function

Calling system commands via RunCommand