Anantshri

The issue is related to an XSS in the js/jquery.prettyPhoto.js file.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters and files, including the `league` parameter to files such as "football classification.php", "football criteria.php", "templates/template default preview.php", or "templates/template worldCup preview.php"; the `f` parameter to "football-functions.php"; the `id` parameter in an "action" action to files like "football groups list.php", "football matches list.php", "football matches phase.php", or "football phases list.php"; or the `id league` parameter in a delete action to "football matches load.php".

The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the `id` parameter in the edit action to "wp-admin/admin.php".

The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the `snode` parameter. This is a directory traversal vulnerability in the lastfm-proxy.php file.

The issue allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands. This can be achieved via vectors related to admin functions.php or admin update.php. For example, the `id` parameter in the update action to "wp-admin/admin.php" is vulnerable.

A directory traversal issue exists, allowing remote attackers to read arbitrary files by using a .. (dot dot) in the `file` parameter.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `s` or `o` parameters in the frame-maker.php file.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `lang` parameter in the cal/test.php file.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `uid` parameter in the asset-studio/icons-launcher.php file.

The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the `lang` parameter in the js/test.php file.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `BlipBotID` parameter in the blipbot.ajax.php file.

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `dialog id` parameter in the admin/admin show dialogs.php file.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `s` parameter in the js/window.php file.