Kevinoclamo

A cross-site scripting (XSS) issue exists due to a flaw in the `markup clean href` function. This allows remote attackers to inject arbitrary JavaScript code via a comment.

The issue allows attackers to bypass intended access restrictions via vectors related to an e-mail address field in the `validate form preferences` function in `admin/preferences.php`.

The issue allows remote attackers to read backup archives on Windows servers by defeating a filename-randomization protection mechanism. This can be achieved by providing the `archiv~1.zip` name, which is an 8.3 filename, to the `creer fichier zip` function in `admin/maintenance.php`.

A cross-site scripting issue exists in the `method` parameter in `spikekill.php`.

A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the `cancel url` variable. This issue is due to an incomplete fix that lacked the htmlspecialchars ENT QUOTES flag.

The issue allows remote attackers to execute arbitrary code via the `avgnan`, `outlier-start`, or `outlier-end` parameter in the spikekill.php file.

A directory traversal issue exists, allowing remote attackers to delete any folder using directory traversal sequences in the `deld` parameter. This issue is related to the plugins/ImageManager/backend.php file in Xinha.