Emanuele Gentili

The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the `f` and `fp` parameters.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters. This can be demonstrated using a tag such as "[a@url@page]" in the error.php file.

The issue concerns the mailto component, which fails to validate URLs before sending email messages. This allows remote attackers to transmit spam.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a "passed in" URL.

The issue allows remote attackers to conduct "variable injection" attacks due to the lack of sanitization of variables set with `JRequest::setVar` in `JRequest`. This can have unspecified other impact.