Eric Castaã±Eda

The issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The `user list backend.php` component is affected, specifically the values of the `iDisplayStart` and `iDisplayLength` parameters, which are not sanitized and are used to construct a SQL query to retrieve a list of registered users.

An open redirect issue allows remote attackers to redirect users to arbitrary web sites, potentially leading to phishing attacks. The `redirect` parameter in the identification.php component is not validated, making it vulnerable to exploitation.