Sirdarckcat

The issue arises from improper handling of overlong UTF-8 encoding, making it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML document fragments.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities. This is related to the details of output encoding and improper modification of an HTML attribute. The vulnerability could allow initially disabled scripts to run in the wrong security context, leading to information disclosure.

The issue arises from improper handling of arithmetic expressions and unclosed comments, allowing remote attackers to inject arbitrary web script.

The issue arises from improper handling of certain expressions and methods, including the substr method in document.location.search and document.referrer, specific use of document.location.hash, certain "window[eval" and similar expressions, Function expressions, '=' expressions, and "with" expressions. This allows remote attackers to inject arbitrary web script.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the `cadena` parameter in "busqueda.php" and the `email` parameter in "lista.php" are vulnerable to such injections.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the `id temas` parameter in "busqueda tema.php", the `cadena` parameter in "busqueda.php", the `id autor` parameter in "autor.php", the `email` parameter in "lista.php", and the `id articulo` parameter in "articulo.php".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `go` parameter and the `id` parameter in a rate action.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `user` parameter in the aut verifica.inc.php file.

The issue allows remote attackers to execute arbitrary PHP code via the `adodb` parameter in the index.php file.

The issue allows remote attackers to bypass authentication controls. This is achieved by setting the `ID ADMIN` and `SUPER ADMIN` parameters to 1, effectively allowing unauthorized access.

A remote file inclusion issue exists, allowing remote attackers to execute arbitrary PHP code via a URL in the `conf[classpath]` parameter in the tpl.inc.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `site name` parameter to the "signup.php" endpoint, and the `id`, `deleteuserbanner`, `viewmem`, `viewmemunb`, `viewunmem`, or `deleteuser` parameters to the "admin.php" endpoint.

The issue allows remote attackers to obtain sensitive information, such as database usernames and passwords, due to insufficient access control of the lib.inc file stored under the web document root.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `cfg root` parameter in the members.php file.