Lost.Hacker

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `theme` parameter in the index.php file.

The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the `class path` parameter to specific API endpoints, such as "file.php" or "com del.php".

The issue allows remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the `config` parameter to `magazine.functions.php`.

The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the `theme file` parameter to specific PHP files, such as includes/window top.php and header.php, or by manipulating the `lang file` parameter in control/common.php.

The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the `current user id` parameter to specific API endpoints, such as "familynews.php" and "settings.php".

The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the following parameters: `lang` to "modules/guestbook/blocks/control.block.php", `main module` to "index.php", and `getFile` to "includes/general.functions.php".