Mike

The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. This is achieved via the `$ GET['image']` parameter.

A CRLF injection issue allows remote web servers to bypass intended Content Security Policy (CSP) restrictions and possibly conduct cross-site scripting (XSS) attacks via crafted HTTP headers.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI, specifically by creating a clickable link for a `javascript:` or `data:` URI in the URL field.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and memory consumption. This occurs when a packet with invalid data is sent to UDP port 1701, causing the `l2tp avp print` function to use a bad length value when calling `print octets`.