Xfkxfk

The issue allows remote authenticated users to inject arbitrary web script or HTML via the `description` parameter. This exists in coreadminajaxpagessave-revision.php and coreadminmodulespagesrevisions.php, enabling low-privileged users, such as administrators, to attack high-privileged users, like Developers.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by creating a crafted table name at the "admin/developer/modules/views/create/" endpoint and the injection is visible at the "admin/ajax/auto-modules/views/searchable-page/" or "admin/modules name" endpoints. The estimated number of potentially affected devices worldwide is not available.

Multiple cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package. The issue is triggered by mishandling of the `title`, `version`, or `author name` parameter in manifest.json. This exists in coreadminmodulesdeveloperextensionsinstallunpack.php and coreadminmodulesdeveloperpackagesinstallunpack.php. The vendor notes that any installed package or extension must be implicitly trusted as they can write PHP files.

The issue allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell. This is related to the extraction of a ZIP archive to filename patterns such as `cache/package/xxx/yyy.php`. The problem exists in files `coreadminmodulesdeveloperextensionsinstallunpack.php` and `coreadminmodulesdeveloperpackagesinstallunpack.php`. The vendor notes that any installed package or extension must be implicitly trusted as they have the ability to write PHP files.

The issue allows remote authenticated users to conduct SQL injection attacks via a crafted `tables` object in `manifest.json` in an uploaded package. This issue exists in `coreadminmodulesdeveloperextensionsinstallprocess.php` and `coreadminmodulesdeveloperpackagesinstallprocess.php`. The vendor notes that any installed package or extension must be implicitly trusted as they have the ability to write PHP files.

The issue is related to CSRF, allowing modification of user information, removal of packages, ignoring versions, and setting FTP directories. Specifically, it affects the "core/admin/modules/users/profile/update.php" script, the "index.php/admin/developer/packages/delete/" URI, the "index.php/admin/developer/upgrade/ignore/?versions=" URI, and the "index.php/admin/developer/upgrade/set-ftp-directory/" URI.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by creating a crafted table name at the "admin/developer/modules/designer/" endpoint and the injection is visible at the "admin/dashboard/vitals-statistics/integrity/check/?external=true" endpoint.

A directory traversal issue exists, allowing attackers to read arbitrary files via .. sequences in the `directory` parameter. This is due to a vulnerability in the coreadminajaxdeveloperextensionsfile-browser.php file.

The issue allows an attacker to bypass a safety check by uploading files with specific extensions, such as 'xxx.pht' or 'xxx.phtml', potentially leading to code execution.

The issue exists due to a CSRF flaw. It can be exploited through the "force" parameter to the "/admin/pages/revisions.php" API endpoint, such as "/admin/pages/revisions/1/?force=false", allowing an attacker to unlock a page with a specific `id`, for example, `id=1`.

The issue allows a user to delete their own account, which is supposed to be an admin-only action. This could have security implications as the admin may have other tasks to complete before a user is deleted, such as data backups.

The issue concerns multiple CSRF problems. Specifically, the `clear` parameter to "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and the `from` or `to` parameters to "core/admin/modules/dashboard/vitals-statistics/404/create-301.php" are affected.