Dickysofficial

The issue allows for CSRF, potentially resulting in obtaining admin privileges. The affected endpoint is "public/rolechangeadmin".

The issue allows for obtaining admin privileges through CSRF in the "admin/home#/person/" endpoint.

The issue allows for remote execution of arbitrary PHP code through a CSRF vulnerability. It is specifically found in the "admin/home#/logos/" endpoint.

The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by sending a POST request to the "admin/index.php?s=publish&x=filemanager" endpoint with a filename that has a double extension, such as a .jpg.php file, and setting the Content-Type to image/jpeg.

The issue allows for an XSS attack through the admin/index.php endpoint with specific settings. The attack is facilitated by the `s` and `x` parameters.

The issue allows for an XSS attack. The attack can be performed through the `admin/index.php` endpoint with specific parameters set, such as `s=publish`, `m=module`, and `x`.