Aitor F

The issue arises from missing file type validation in the `r3dfb save thumbnail callback` function, allowing authenticated attackers with Author-level access and above to upload arbitrary files on the affected site's server. This may make remote code execution possible.

The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages via the `RednaoSerializedFields` parameter during the creation of a signature file. This enables the execution of injected scripts whenever a user accesses an injected page.