Andi

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `name` parameter to "modules.php" or the `img url` to "includes/wysiwyg/spaw/editor/plugins/imgpopup/img popup.php".

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `ns` parameter in a medialist action to "lib/exe/ajax.php".