Sowishop

The issue concerns a SQL Injection problem. It is exploitable through the `ids[]` parameter in a "commentadmin" action, specifically via the `check()` and `delete()` functions in `CommentadminController.class.php`, and requires the manager privilege.

The issue is related to SQL Injection via the `edit post()` function in `NavController.class.php`. It can be exploited with manager privilege using the `parentid` parameter in a "nav" action.

The issue concerns a SQL Injection problem via the `delete()` function in `SlideController.class.php`. It can be exploited by an attacker with manager privileges through the `ids[]` parameter in a slide action.

The issue concerns a SQL Injection vulnerability via the ` listorders()` function in `AdminbaseController.class.php`. This can be exploited with manager privilege through the `listorders[key][1]` parameter in a "Link listorders" action.

The issue concerns a SQL Injection problem via the `edit post` method in `ArticleController.class.php`. It can be exploited by normal authenticated users through the `post[id][1]` parameter in an article `edit post` action.

An issue was discovered in YMFE YApi, where there is stored XSS in the `name` field of a project.