8Bitsec

يحتوي البرنامج على ثغرة في تنفيذ التعليمات البرمجية تسمح للمهاجمين بتنفيذ أوامر تعسفية على النظام عند إنشاء ملف Markdown ضار. يمكن للمهاجم تضمين مصدر فيديو يحتوي على حدث onerror، والذي يقوم بدوره بتنفيذ أوامر shell باستخدام وحدة child process في Node.js عند فتح الملف. المكون المعرض للخطر هو معالجة ملفات Markdown. يتم استغلال الحدث `onerror` لتشغيل الأوامر.

The issue concerns a cross-site scripting (XSS) flaw via exam input text fields. This allows for potential malicious script injection. No information is provided about the estimated number of affected devices or real-world incidents.

The issue concerns SQL injection via the `id` parameter in the "wp-admin/admin.php?page=examapp UserResult" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

Name of the Vulnerable Software and Affected Versions: Shopy Point of Sale version 1.0 Description: A CSV Injection issue was discovered that allows a user with low-level privileges to inject a command into the exported CSV file, potentially leading to code execution. Recommendations: For Shopy Point of Sale version 1.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: clustercoding Blog Master Pro version 1.0 Description: A CSV Injection issue was discovered that allows a user with low-level privileges to inject a command into the exported CSV file, potentially leading to code execution. Recommendations: For version 1.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: A Local File Inclusion issue was discovered, which can be exploited by a low-privileged user. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: An Authenticated Stored XSS issue was found, which can be exploited by a low-privileged user. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: A SQL Injection issue was discovered that allows a user with low-level privileges to directly modify the SQL query. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: HRSALE The Ultimate HRM version 1.0.2 Description: A CSV Injection issue was discovered that allows a user with low-level privileges to inject a command into the exported CSV file, potentially leading to code execution. Recommendations: For HRSALE The Ultimate HRM version 1.0.2, consider disabling the CSV export feature until a patch is available to prevent potential code execution.