Dilillearngent

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities are located at the "/dede/vote add.php" API endpoint via the `votename` and `voteitem1` parameters.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities are located at the "/dede/vote edit.php" API endpoint via the `votename` and `votenote` parameters.

A cross-site scripting (XSS) issue was found in DedeCMS. The issue is located at the "/dede/freelist add.php" API endpoint via the `title` parameter.

A cross-site scripting (XSS) issue was found in DedeCMS. The issue is located at the "/dede/freelist edit.php" API endpoint via the `title` parameter.

A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the `description` parameter in the "insert.php" endpoint. This enables the attacker to perform unauthorized actions on the system.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `ticket id` parameter at the "ticket detail.php" endpoint. This enables the attacker to potentially access or manipulate sensitive data.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `emp id` parameter at the "employee detail.php" endpoint. This enables the attacker to potentially access or manipulate sensitive data.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `id` parameter at the "daily expenditure edit.php" endpoint. This enables the attacker to potentially access and manipulate sensitive data.

A remote attacker can execute arbitrary code via a crafted PHP file to the "artical.php" endpoint. This issue allows for the execution of arbitrary code, potentially leading to system compromise.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `emp id` parameter at the "employee edit.php" endpoint. This enables the attacker to potentially access and manipulate sensitive data.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `costomer id` parameter at the "customer edit.php" endpoint. This enables the attacker to manipulate database queries, potentially leading to unauthorized data access or modification.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `page id` parameter at the "article edit.php" endpoint. This enables the attacker to potentially access and manipulate sensitive data.

A remote attacker can execute arbitrary code via a crafted PHP file to the "employee insert.php" endpoint. This allows for the potential execution of malicious code, posing a significant risk. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.