The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files

The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering

A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product