Canberk Bolat

A XML external entity (XXE) issue in the `api/rest/status` endpoint allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks by sending a crafted DTD in an XML request.

The issue concerns a CSRF token bypass in the servlet/UserServlet endpoint. This allows for potential exploitation via the `u name`, `u passwd1`, `u passwd2`, `role`, and `X-XSRF-TOKEN` POST parameters.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the `name` or `pass` parameters in specific files, including views/login.php and views/signup.php.

The issue allows remote attackers to execute arbitrary SQL commands via the `u` parameter in the interface/login/validateUser.php file.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the "handlers/getpage.php" file.