The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters, including `banned word[]` to "/index.php/dashboard/system/conversations/bannedwords/success", `channel` to "/index.php/dashboard/reports/logs/view", `accessType` to "/index.php/tools/required/permissions/access entity", `msCountry` to "/index.php/dashboard/system/multilingual/setup/load icon", `arHandle` to "/index.php/ccm/system/dialogs/area/design/submit" or "/index.php/ccm/system/dialogs/area/design", `pageURL` to "/index.php/dashboard/pages/single", `SEARCH INDEX AREA METHOD` to "/index.php/dashboard/system/seo/searchindex/updated", `unit` to "/index.php/dashboard/system/optimization/jobs/job scheduled", `register notification email` to "/index.php/dashboard/system/registration/open/1", or `PATH INFO` to "/index.php/dashboard/extend/connect/".