Eric Flokstra

The issue concerns directory traversal during file download. This occurs via the `view` parameter in the "BrowseFiles.php" endpoint.

The issue is an unauthenticated SQL injection in the `p` parameter of the "process login.php" login form. This allows for potential exploitation without the need for authentication.

The issue is related to authenticated SQL injection. It affects the `id` parameter of the "IPPhoneFirmwareEdit.php" endpoint.

An issue allows remote code execution via directory traversal in the `dir` parameter of the file upload functionality of "BrowseFiles.php". An attacker can upload a .php file to "WebAdmin/admin/AudioCodes files/ajax/".

An issue was discovered that allows execution of commands. The "/BrowseFiles.php" API endpoint is vulnerable to a POST request with a `cmd` parameter set to "ssh" and an `ssh command` field, which is then executed.

The issue is related to stored XSS via the `desc` parameter in the "ajaxTenants.php" endpoint.

The issue is related to an open redirect vulnerability.

The issue allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the `image path`, as demonstrated by "image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd". This is a directory traversal vulnerability in the Chorus2 add-on for Kodi.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of victims for requests that upload code.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks. This is achieved via the `image file` parameter in an edit action in the "cnss social icon add" page to "wp-admin/admin.php".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the QUERY STRING in the "wc-reports" page to "wp-admin/admin.php".