Lazizbek Djurayev

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.

**Name of the Vulnerable Software and Affected Versions** Dozzle versions prior to 11.1.2 **Description** Insufficient sanitization of container display names occurs when building ZIP archive entry names in the log download endpoint. Attackers with the ability to label containers can employ path traversal sequences—a technique used to access files and directories outside the intended folder—to write files outside the extraction directory when users download and extract logs. **Recommendations** Update to version 11.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Nginx Proxy Manager versions prior to 2.16.1 **Description** Lack of rate-limiting on authentication endpoints allows unauthenticated attackers to perform unlimited password guessing against any account. Attackers can brute-force login credentials via the 'POST /api/tokens' endpoint and subsequently guess Time-based One-Time Password (TOTP) codes via the 'POST /api/tokens/2fa' endpoint to obtain full session access and administrative control. **Recommendations** Update Nginx Proxy Manager to a version newer than 2.16.0. Restrict access to the 'POST /api/tokens' and 'POST /api/tokens/2fa' endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Nginx Proxy Manager versions prior to 2.16.1 **Description** Non-administrator users with manage permissions can inject arbitrary nginx directives because the software fails to restrict the `advanced config` field to administrators. This allows attackers to implement malicious configurations, such as using alias directives to serve arbitrary files or manipulating routing for their assigned hosts. **Recommendations** Update to version 2.16.1 or later. Restrict access to the `advanced config` field to only authorized administrator accounts.

**Name of the Vulnerable Software and Affected Versions** Flame versions prior to 2.4.1 **Description** An information exposure issue exists in the unauthenticated 'GET /api/config' endpoint, which returns the complete configuration object without redacting sensitive fields. This allows an attacker to retrieve internal operational settings and the stored weather API key by sending a single unauthenticated request, potentially leading to the consumption of provider quotas or unauthorized access to sensitive data. **Recommendations** Update Flame to version 2.4.1 or later. As a temporary mitigation, restrict access to the 'GET /api/config' endpoint.

**Name of the Vulnerable Software and Affected Versions** FileRise versions prior to 3.28.0 **Description** Improper session isolation between the WebDAV interface and the web application session context allows authenticated low-privilege attackers to gain unauthorized read and write access. By combining valid Basic-Auth credentials with an active admin `PHPSESSID` cookie, attackers can bypass authorization boundaries. This occurs because the WebDAV layer incorrectly inherits elevated privileges from an ambient web session instead of enforcing independent stateless authentication as required by RFC 4918. **Recommendations** Update to version 3.28.0 or later.