Srpopty

The issue is caused by a lack of input validation, resulting in an open redirect and XSS issue within the new mfa selection screen.

A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the Comment Manager component, specifically through the "/admin/manage-comments.php" API endpoint. This enables the attacker to inject malicious scripts into the application.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `rank *` parameter in the "/dedestory catalog.php" endpoint.

A SQL injection issue allows a remote attacker to execute arbitrary code via the `rank *` parameter in the "/dede/group store.php" endpoint.

A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the `Post Editor` parameter. This enables the attacker to inject malicious scripts into the website, potentially leading to unauthorized access or data theft.

A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter. This enables the attacker to perform unauthorized actions on the affected system.

A cross site scripting (XSS) issue allows attackers to execute arbitrary code via the `datetline`, `title`, `tpp`, or `username` parameters through the audit search. This enables attackers to inject malicious scripts into the website, potentially leading to unauthorized actions.

A reflected-XSS issue was discovered in the article publish component. The issue is related to the cookie `ENV LIST URL`.

A reflected-XSS issue was discovered in the FileManager component. The issue occurs in the GET parameter `filename` when editing any file.

A reflected-XSS issue was discovered in the article attribute editor component. This occurs when the POST value `value` contains a non-integer character.

A reflected-XSS issue was discovered in the article type editor component. The issue occurs when the POST value `name` contains a malformed UTF-8 character.

A reflected-XSS issue was discovered in the FileManager component. The issue occurs when creating a new file and is related to the `activepath` variable in the GET request.

A reflected-XSS issue was discovered in the article publish component. The issue is related to the cookie `ENV GOBACK URL`.