userSpice vulnerabilities

userSpice 4.3.24 has a username enumeration vulnerability. An unauthenticated attacker can send POST requests to existingUsernameCheck.php and analyze responses to find existing accounts.

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header, which execute when administrators visit the audit log page.