Mesut Timur

The issue is related to the improper initialization of the XML parser or the choice of handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks. This can occur through vectors involving spreadsheets in OOXML files and XMP metadata in PDF and other file formats.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting (XSS) attacks.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `newtopic` parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic, or the query string to SlideShow.pm in the SlideShowPlugin.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `origurl` parameter to a (1) view script or (2) login script.

The issue allows remote authenticated users to inject arbitrary web script or HTML via administrator screens in the Back End, due to multiple cross-site scripting (XSS) vulnerabilities.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `handler` parameter to API endpoints such as "index.php" and possibly "admin/index.php", and the `topic` parameter to "modules/feed/feed.php".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `nav ID` parameter in the "index.php" and possibly "admin/index.php" files.