Emilio Pinna

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `fileDate` parameter in a "DOWN" call to the 'vmtadmin.cgi' endpoint.

The issue allows remote attackers to conduct PHP object injection attacks. This is due to improper handling of an object obtained by unserializing a description of an external badge in the badges/external.php file. The attack can be conducted via unspecified vectors, such as overwriting the value of the `userid` parameter.

A cross-site scripting (XSS) issue exists in the print textinputs var function, allowing remote attackers to inject arbitrary web script or HTML via `textinputs` array parameters. Multiple vulnerabilities in the FCKeditor package may lead to a breach of protected information integrity, and exploitation can be done remotely.