Description
SQL injection and cross-site scripting (XSS) vulnerabilities exist in EasyPublish. Multiple input parameters lack proper sanitization for both database operations and HTML rendering.
Impact
SQL injection enables unauthorized database access including data extraction and modification. XSS allows attackers to execute arbitrary JavaScript in other users' browsers, leading to session hijacking.
Solution
Apply parameterized queries and output encoding. Contact the vendor for security patches.