Cross-site scripting (XSS) vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the inFullname parameter in an UpdateAccountSettings action in the my_account module to zpanel/.
ZPanel versions 10.0.1 and below suffer from cross site request forgery, cross site scripting, password reset, and remote SQL injection vulnerabilities.