Net.Edit0R

The issue allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php. This is due to a problem in the functions vbseo hook.php file within the VBSEO module.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `var1` and `keyword` parameters in the main.php file.

The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the main.php file. This is achieved by using a .. (dot dot) in the `var1` parameter.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a parameter. For example, the `project id` parameter to the "search.php" endpoint is vulnerable. This could potentially lead to malicious script execution.