The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an una

Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web applica

Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx install