Description
This script is using the PHP function preg_replace() on user input. This is not recommended as it can lead to various vulnerabilities. Consult "Web references" for more information about this problem.
The e modifier makes preg_replace() treat the replacement parameter as PHP code after the appropriate references substitution is done. If the regex pattern and the replacement strings are controlled by the user this can conduct to PHP code execution.
Remediation
It is not recommended to use preg_replace() on user input.
References
Related Vulnerabilities
ThinkPHP v5.0.22/5.1.29 Remote Code Execution Vulnerability
WordPress Plugin Events Manager CSV Injection (5.9.7.1)
WordPress Plugin PHP Speedy 'admin_container.php' Remote PHP Code Execution (0.5.2)
WordPress Plugin Newsletter-Send awesome emails from WordPress CSV Injection (6.5.3)
Ruby Improper Input Validation Vulnerability (CVE-2011-4815)