PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.