Andrew Lyons

توجد مشكلة تتمثل في فشل البرنامج في تنقية المعلمة `id` وتشفيرها بشكل صحيح قبل دمجها في عبارة SQL. يؤدي ذلك إلى حدوث حقن SQL، وهو ما يمكن استغلاله من قبل المستخدمين الذين يمتلكون صلاحية معينة. ورغم أن هذه الصلاحية مقيدة بالمسؤولين بشكل افتراضي، إلا أنه يمكن تفويضها إلى أدوار ذات امتيازات أقل.

The issue is related to a cache poisoning risk, which may allow an attacker to gain access to confidential information through caching. Additional validation for local storage was required to address this risk.

The issue is related to an elevation of privilege vulnerability that allows remote attackers to inject arbitrary web script or HTML via a crafted string. This vulnerability enables cross-site scripting (XSS) attacks, which can be exploited by an attacker to run a script in the security context of the current user.

The issue allows remote attackers to inject arbitrary web script or HTML via a crafted string. This is due to an elevation of privilege vulnerability in the way that HTML strings are sanitized. An attacker who successfully exploited this vulnerability could perform cross-site scripting attacks and run script in the security context of the logged-on user.