Longrifle0X

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of admins for specific requests, including adding group plans via "admin/group plans.html" and adding extra packages via "admin/extra packs/create extra pack.html".

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved via the `createrule` parameter to "dnat.cgi", the `addrule` parameter to "dansguardian.cgi", or the `PATH INFO` to "openvpn users.cgi".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter to the "index.php" endpoint.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.

The issue allows remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the `file` parameter to "document.php" or `backtopage` parameter in a create action to "comm/action/fiche.php".

The issue allows remote attackers to execute arbitrary SQL commands via the `id` parameter in the `/wptouch/ajax.php` API endpoint.

The issue allows remote attackers to execute arbitrary SQL commands via the `id` parameter in the modules/sharedaddy.php file.