I've found a security vulnerability, line 267 of contexthelp.module. The $url variable is not escaped and that allows SQL Injection via the url in your browser.

Here is a patch to fix this :

CommentFileSizeAuthor
fix-SQL-Injection-contexthelp.module.patch850 bytesShrek