Xiaotian.Wang

The issue is related to the lack of protection against SQL query structure exploitation in the /web/Public/Conn.php component. This allows a remote attacker to execute arbitrary code. The problem arises because input is not validated, enabling arbitrary SQL statements to be executed in the database via the `dbSQL` parameter in the /web/Public/Conn.php endpoint.

A reflected Cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `operation` parameter to the "/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet" API endpoint.

The issue allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server. This is achieved by including a `computerName=../` substring in the request to the "/agenttrayicon" API endpoint.

The issue concerns Arbitrary File Upload and Remote Code Execution in PHP Scripts Mall Schools Alert Management Script. This is achieved through the `$ FILE` variable in the `/webmasterst/general.php` endpoint, allowing an attacker to upload a .php file with the image/jpeg content type.

A cross-site scripting (XSS) issue exists, allowing remote anonymous users to inject arbitrary web script or HTML. This is related to the `die html input error` function in `lib/html validate.php` and is exploited via the `id` parameter in `link.php`.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by sending crafted serialized data in the `selected graphs array` parameter in a save action, exploiting the `host new graphs save` function in `graphs new.php`.