Daniel Bishtawi

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected parameters include the `destination` parameter in the delete and edit features, and the `content` parameter in the profile feature.

Name of the Vulnerable Software and Affected Versions: AbanteCart version 1.2.12 Description: The issue is related to reflected cross-site scripting (XSS) that can be triggered via the `sort` parameter. An example of exploitation is demonstrated by a substring in the URL '/apparel--accessories?sort='. Recommendations: For AbanteCart version 1.2.12, consider restricting access to the `sort` parameter in the affected API endpoint until a patch is available. As a temporary workaround, avoid using the `sort` parameter in URLs to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Zenphoto version 1.4.14 Description: The issue is related to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities can be exploited via different URL parameters. Recommendations: For Zenphoto version 1.4.14, update to a newer version that contains a fix for this issue.

The issue is related to reflected cross-site scripting (XSS), which can potentially allow attackers to inject malicious scripts into websites.

The issue is related to a problem in the pagination sorting functionality. It allows for XSS, which can be exploited.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. The affected parameters include the `keyword` parameter to "groups.php", the `username` parameter to "login.php", and the `date` parameter to "search.php".

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `id` parameter to "join group.php" or the `comment id` parameter to "story.php".