Kimiizhang

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.

A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the `cancel url` variable.

A cross-site scripting (XSS) issue exists, allowing remote anonymous users to inject arbitrary web script or HTML. This is related to the `die html input error` function in `lib/html validate.php` and is exploited via the `id` parameter in `link.php`.