Jrsfaisal

The issue allows for an Unrestricted File Upload via an Attachment Document in the article feature. This leads to uploading arbitrary PHP code by using a .php filename with the application/pdf Content-Type.

The issue is related to reflected Cross Site Scripting (XSS) that can be triggered via the `cari` parameter in an index.php/first?cari= URI. This allows for potential malicious script injection.

The issue allows an attacker to add an account at the admin level. This is achieved via the "index.php/man user/insert" API endpoint.

A Reflected Cross-Site Scripting (XSS) issue exists in the Master File module. The issue is triggered via an admin/modules/master file/rda cmc.php?keywords= URI.

A Reflected Cross-Site Scripting issue exists in the Bibliography module. This is due to insufficient input validation in the `keywords` parameter of the `/admin/modules/bibliography/index.php` API endpoint.

The issue allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the `csrf token` parameter.

A Reflected Cross-Site Scripting (XSS) issue exists in the Stock Take module. This can be exploited via the `/admin/modules/stock take/index.php?keywords=` API endpoint, specifically through the `keywords` variable.

A Reflected Cross-Site Scripting (XSS) issue exists in the Circulation module. The issue is related to a URI in the admin/modules/circulation/loan rules.php file, specifically with the `keywords` parameter.

A Reflected Cross-Site Scripting (XSS) issue exists in the Membership module. This issue can be triggered via the `/admin/modules/membership/index.php?keywords=` API endpoint, where the `keywords` parameter is vulnerable.