Cnluminous

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send message mobile of the file controllers/simple.php. Such manipulation of the argument user id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin repwd/admin repwd act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/ userInfo/ userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmWidget. Performing a manipulation of the argument text results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** Mstfakts College-Management-System (affected versions not specified) **Description** A flaw in the Authentication component allows for remote session fixation. This occurs within the `session start()` function located in the `Front-end/server.php` file. Session fixation is a method where an attacker provides a valid session identifier to a user and then hijacks the session once the user authenticates. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `Front-end/server.php` file or the `session start()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** sfturing hosp order versions prior to 627f426331da8086ce8fff2017d65b1ddef384f8 **Description** A remote cross site scripting issue exists within the Public Search Handlers component, specifically in the `HospitalController.java` file. The flaw allows an attacker to execute malicious scripts by manipulating the `Search` argument. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rizwan17 inventory-management-system versions up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f **Description** A flaw in the Login Page component exists within the `index.php` file. Remote attackers can perform cross-site scripting by manipulating the `msg` argument. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** light0011 cms (affected versions not specified) **Description** An issue exists in the Debug Mode component within the file App/Common/Conf/config.php. Remote manipulation of the `DB DEBUG` argument can lead to information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** mjperpinosa stumasy حتى الإصدار 327d1b0f2915ba79d7ef8ebb74553e987609d9be **الوصف** توجد ثغرة في البرمجة النصية عبر المواقع عن بُعد (XSS) ناتجة عن المعالجة غير الصحيحة لمرجع الوسيطة داخل الدالة `add definition()` الموجودة في الملف application/PHP/objects/notes/add into dictionary.php. **التوصيات** كحل مؤقت، يُنصح بتقييد استخدام الدالة `add definition()` حتى يتوفر تصحيح. في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** mjperpinosa stumasy حتى الإصدار 327d1b0f2915ba79d7ef8ebb74553e987609d9be **الوصف** من الممكن إجراء حقن SQL عن بُعد بسبب المعالجة غير الصحيحة لحجة `field name` داخل الدالة `Notes controller::search scratch data()` الموجودة في الملف application/PHP/objects/notes/search scratch data.php. حقن SQL هو تقنية يقوم فيها المهاجم بإدراج كود SQL ضار في استعلام، مما يسمح له بالتلاعب بقاعدة البيانات. **التوصيات** كحل مؤقت، يُنصح بتقييد استخدام الحجة `field name` في الدالة `Notes controller::search scratch data()` إلى أن يتوفر تصحيح. في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** mjperpinosa stumasy (لم يتم تحديد الإصدارات المتأثرة) **الوصف** توجد مشكلة تتعلق بتحميل الملفات دون قيود في الملف ’application/PHP/objects/updates/add post.php‘. يمكن لمهاجم عن بُعد شن هجوم من خلال التلاعب بالمعلمة `up file to post`، مما يسمح بتحميل ملفات غير مصرح بها. **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.