Cross-site scripting (XSS) vulnerability in departmentofflinecontext.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to inject arbitrary web script or HTML via the departmentid parameter to index.php.
SQL injection vulnerability in departmentofflinecontext.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to execute arbitrary SQL commands via the departmentid parameter to index.php.