Howchen

The issue concerns open redirects. Specifically, it affects the `FORWARD URL` parameter in the html/common/forward js.jsp endpoint and the `hostname` parameter in the html/portlet/ext/common/page preview popup.jsp endpoint.

The issue concerns an information leakage risk, where sensitive data such as PATH, DOCUMENT ROOT, and SERVER ADMIN may be exposed. This is related to the file libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php.

The issue occurs when an individual attempts to register an account with a crafted `password` parameter to the "users/registration" endpoint. This is a distinct issue from previously identified vulnerabilities.

The issue allows HTTP header injection in the `cfg` parameter of the plugins/captcha/crypt/cryptographp.php file.

The issue concerns a problem with the dotCMS software. It is reported that there is an XSS issue in the /html/portlet/ext/contentlet/image tools/index.jsp "fieldName" and "inode" parameters.

The issue allows an unauthenticated user to execute arbitrary SQL commands. This is achieved via the "diy/module/member/controllers/Api.php" file, specifically through the `ajax save draft` function, by manipulating the `dir` parameter.

An issue allows remote code execution via PHP code in a multipart/form-data POST to the "admin.php?s=/Tpl/Update.html" API endpoint. This can be used to update files, such as Web/Tpl/default/head.html.

An issue was discovered where the software relies on the PHP `time()` function for cookies. This makes it possible to determine the cookie for an existing admin session via a certain number of guesses.

An issue was discovered in damiCMS, where Directory Traversal is possible via '|' characters in the `s` parameter to "admin.php", as demonstrated by an "admin.php?s=Tpl/Add/id/c:|windows|win.ini" URI.