Multiple XSS Vulnerabilities in Mailcow

A critical unauthenticated XSS, and another interesting Self-XSS escalation involving a Login CSRF with a leftover tab