Snup

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `question` parameter to `/modules/poll/add.php` or the `question` or `answer` parameters to `/modules/poll/edit.php`.

A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that create a poll via an add action to the poll module.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `start` parameter to `mod.php`.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `TOPIC ID` parameter in the "forum.asp" endpoint.

The issue concerns SQL injection vulnerabilities in the ssearch.php file of the Siche search module. Remote attackers can execute arbitrary SQL commands by manipulating certain parameters. The vulnerable parameters include `ss`, `sm`, `align`, and `category`.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `search` parameter in the ssearch.php file.