Some PHP files did not properly escape input.
Some files could operate like "open redirects". A bad actor
could form an URL that looks like it came from a trusted
site, but the user would be redirected or load content from
the bad actor's site.
A file exposed a more serious cross-site scripting
vulnerability with the possibility of executing code on the
domain where the file exists.
The Dojo build process defaulted to copying over tests and
demos, which are normally not needed and just increased the
number of files that could be targets of attacks.