Enferaso

The issue is related to a Cross Site Scripting (XSS) vulnerability. It occurs via the `username` input in the file User model.php.

The issue allows attackers to execute arbitrary code via the `languages` and `trans load` parameters in the file add product.php. This is a Cross Site Scripting (XSS) issue.

A cross-site scripting (XSS) issue was found in the setStorageParams function within SettingController.php.

The issue is related to a cross-site scripting (XSS) vulnerability. It affects the `uploadchannel()` function, allowing for potential exploitation.

A cross-site scripting (XSS) issue was found in the /master/index.php component of PicUploader. This allows for potential malicious script execution.

A cross-site scripting (XSS) issue was found in the post function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation.

A cross-site scripting (XSS) issue was found in the `handle file upload` function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

A cross-site scripting (XSS) issue was found in Vesta via the `generate response` function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation.

A cross-site scripting (XSS) issue was found in the body function at the "/web/api/v1/upload/UploadHandler.php" API endpoint. This allows for potential exploitation.

A cross-site scripting (XSS) issue was discovered in the ` generateFilename` function. This allows for potential malicious script execution. No information is provided about the estimated number of affected devices or real-world incidents.

Name of the Vulnerable Software and Affected Versions: dzzoffice version 2.02.1 SC UTF8 Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the explorerfile.php file. This vulnerability affects the output of the exit function, which is printed for the user via exit(json encode($return)). Recommendations: For dzzoffice version 2.02.1 SC UTF8, consider restricting access to the explorerfile.php file to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the exit function with user-input data in the affected file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ThinkUp version 2.0-beta.10 Description: The issue is a path manipulation vulnerability in Smarty.class.php. This vulnerability only affects products that are no longer supported by the maintainer. Recommendations: For ThinkUp version 2.0-beta.10, as a temporary workaround, consider restricting access to the vulnerable Smarty.class.php file until further guidance is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: thinkphp-bjyblog (affected versions not specified) Description: The issue concerns a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The `exit` function terminates the script and prints a message to the user that contains the `HTTP HOST` server variable. This could potentially allow an attacker to inject malicious scripts into the webpage. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: pictshare version 1.5 Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the "api/info.php" endpoint. The exit function will terminate the script and print a message that includes the value of the `hash` variable from the $ REQUEST array. This suggests that an attacker could potentially inject malicious scripts by manipulating the `hash` parameter. Recommendations: For pictshare version 1.5, consider disabling the "api/info.php" endpoint until a patch is available to prevent exploitation of the XSS vulnerability. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation. Avoid using the `hash` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: nZEDb version 0.4.20 Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the www/pages/api.php file. The `exit` function terminates the script and prints a message that includes the input from `$ GET['t']`. This allows for potential XSS attacks by manipulating the `$ GET['t']` variable. Recommendations: For nZEDb version 0.4.20, consider restricting access to the `www/pages/api.php` file until a patch is available. As a temporary workaround, avoid using the `$ GET['t']` variable in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ecshop version 2.7.3 Description: The issue is a SQL injection vulnerability located in the `shopexecshopuploadapiclientapi.php` file. This vulnerability can be exploited through the API endpoint `/api/client/api.php`, although the specific `variables` or `function names` involved are not detailed. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: For ecshop version 2.7.3, as a temporary workaround, consider restricting access to the `api.php` file in the `shopexecshopuploadapiclient` directory until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libretime version hv3.0.0-alpha.10 Description: The issue is related to a path manipulation vulnerability. It affects the `/blob/master/legacy/application/modules/rest/controllers/ShowImageController.php` file through the `rename` function. Recommendations: For libretime version hv3.0.0-alpha.10, consider restricting access to the `ShowImageController.php` file until a patch is available. As a temporary workaround, avoid using the `rename` function in the affected controller to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: tripexpress version 1.1 Description: The issue concerns a path manipulation vulnerability in the file system/helpers/dompdf/load font.php. The `src` variable, which comes from `$ SERVER["argv"]`, is involved in this vulnerability. Recommendations: For tripexpress version 1.1, consider restricting access to the load font.php file in the dompdf directory to minimize the risk of exploitation. As a temporary workaround, avoid using the `src` variable from `$ SERVER["argv"]` in the load font.php file until a patch is available.