Abdulaziz Saad

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Rafed CMS Website الإصدار 1.44 الوصف: ثغرة أمنية من نوع البرمجة النصية عبر المواقع (XSS) في مكون index.php الخاص بـ Rafed CMS Website تسمح للمهاجمين بتنفيذ نصوص برمجية ويب أو HTML عشوائية عبر حمولة معالجة. التوصيات: بالنسبة لـ Rafed CMS Website الإصدار 1.44، يُنصح بتعطيل المكون index.php حتى يتوفر تصحيح. قم بتقييد الوصول إلى ملف index.php لتقليل مخاطر الاستغلال. تجنب استخدام الحمولات المُعدلة في المكون المتأثر حتى يتم حل المشكلة. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

An issue in the `delete post()` function allows unauthenticated attackers to arbitrarily delete posts.

The issue allows unauthenticated attackers to arbitrarily create or update user accounts due to a problem in the save users() function.

A cross-site scripting issue in the ads comment section allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

A reflected cross-site scripting (XSS) issue was found in the User Upgrade Form. This could potentially allow attackers to inject malicious scripts into the website, affecting users who interact with the compromised form.

A cross-site scripting issue in the DM Section component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

A stored cross-site scripting (XSS) issue was found in the Post Ads component. This allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized actions or data theft.

The issue concerns SQL Injection, which can be exploited via the "reports/daily collection report.php" endpoint. Specifically, the vulnerability is located at line 59 of this file.

The issue concerns a SQL Injection vulnerability. It can be exploited via the "accounts/payment history.php" endpoint, specifically at line 31.

The issue is related to reflected cross-site scripting (XSS) in the admin/inc/navigation.php file at line 125. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the user's browser.

A reflected cross-site scripting (XSS) issue was found in the Admin panel. The vulnerability is exploited via the `page` parameter in the $ GET request. This allows an attacker to inject malicious scripts into the webpage, potentially leading to unauthorized actions or data theft.

A reflected cross-site scripting (XSS) issue was found in the Admin panel of Home Owners Collection Management. The vulnerability is exploited via the `$ GET['s']` parameter.