2Mzrp

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `var1` and `keyword` parameters in the main.php file.

The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the main.php file. This is achieved by using a .. (dot dot) in the `var1` parameter.