Jing Wang

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `url` parameter in the goto.php file.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `HTMLForm` parameter. This could potentially lead to unauthorized actions on the affected system.

A directory traversal issue exists, allowing remote attackers to have an unspecified impact by using directory traversal sequences in the `mappa` parameter to the "index.php" endpoint.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `termid` or `nyelv id` parameter to the "index.php" endpoint.

The issue allows remote attackers to obtain the installation path. This is achieved via the `redirect url` parameter to "netshop/post.php" API endpoint.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `c` parameter in the "index.php" endpoint.

The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the `page`, `c`, or `redirect` parameter to `index.php`, or the `searchTerm` parameter in the main page's search field.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `page` or `category` parameter to "forum.php" or the `page` or `order` parameter to "board entry.php" or "forum entry.php".

A cross-site scripting (XSS) issue exists in the logon page, allowing remote attackers to inject arbitrary web script or HTML via the `url` parameter. This enables attackers to execute malicious scripts on the client-side.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include `search param` to the "search.php" endpoint, and `name`, `address`, or `comment` parameters to the "forms.php" endpoint.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the `TargetResource` parameter in the startSSO.ping endpoint.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `out` parameter. This is achieved through an open redirect vulnerability in the track-click.php file.