Nicolas Serra

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `project` or `id` parameters to "topics/deletetopics.php", the `id` parameter to "bookmarks/deletebookmarks.php", or the `id` parameter to "calendar/deletecalendar.php".

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension to the clients/editclient.php script, and then accessing it via a direct request to the file in logos clients/.

The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via several parameters to specific API endpoints, including `bp name`, `display`, `search`, or `equipment` to "module/monitoring ged/ged functions.php" or the `type` parameter to "monitoring ged/ajax.php".

The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the `selected events[]` parameter. This can occur in the `acknowledge`, `delete`, or `ownDisown` function in `module/monitoring ged/ged functions.php` or the `module` parameter to `module/index.php`.