Secunia

Multiple vulnerabilities have been identified in Enceladus allowing malicious users to conduct Cross Site Scripting and retrieve passwords.

1) Usernames and passwords are stored in clear text in the "\Program Files\enceladus\users" folder. This allows local users to read the information.

2) When signing the Guestbook the email and comments parameters aren't verified properly allowing malicious users to conduct Cross Site Scripting.

3) Any user with access to the secure download folder can retrieve the .htaccess file with usernames and hashed passwords.

This has been reported to affect version 3.9.11

Solution
Make sure that only trusted users got access to the local system.
Further details available in Customer Area

Provided and/or discovered by
Ziv Kamir

Deep Links
Links available in Customer Area