Haunt It

The issue allows for XSS via the `index.php?action=pm;sa=settings;save` sa parameter. This means an attacker could potentially inject malicious scripts into the website, affecting user sessions.

The issue allows for local file inclusion, which can result in remote code execution. This is achieved through directory traversal in the `db type` parameter of the install.php file. The vulnerability is exploitable if the install.php file remains present after the installation process.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `jsoncallback` parameter in the index.php/Admin Preferences file.

The issue allows remote attackers to obtain sensitive information via an invalid `courses ID` parameter in the `lesson info` module to "index.php", which reveals the installation path in an error message.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `message` parameter in an income action to "administrator/index.php".

The issue allows remote attackers to obtain sensitive information. This can be achieved by providing a long string or invalid characters in a `cookie`, which results in an error message that reveals the installation path.

The issue allows remote attackers to obtain sensitive information via an invalid character in the `PHPSESSID`, which reveals the installation path in an error message.

The issue allows remote attackers to obtain sensitive information. This is achieved via the `emailsearch` parameter, which reveals the installation path in an error message.

A cross-site scripting (XSS) issue exists in the default index page in admin/ due to improper validation of user input. This allows remote attackers to inject arbitrary web script or HTML via the `p` parameter in the affected API endpoint "/admin/".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a long string in the `subject` parameter when creating a post.

A cross-site scripting (XSS) issue exists in the registration page, allowing remote attackers to inject arbitrary web script or HTML.