Balvinder Singh

**Name of the Vulnerable Software and Affected Versions** CuppaCMS (affected versions not specified) **Description** The issue is related to a Cross-Site Scripting (XSS) attack. It occurs when an SVG document is uploaded to the administrator/#/component/table manager/view/cu views URI, allowing malicious scripts to be executed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nucleus CMS version 3.70 **Description** The issue allows for HTML Injection via the `body` parameter in `index.php`. **Recommendations** For Nucleus CMS version 3.70, avoid using the `body` parameter in the `index.php` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** CuppaCMS versions prior to 2018-09-03 **Description** A stored XSS issue exists, allowing exploitation via the section name in the administrator/#/component/table manager/view/cu menus section. **Recommendations** For versions prior to 2018-09-03, update to a version released after 2018-09-03 to resolve the issue. As a temporary workaround, consider restricting access to the administrator/#/component/table manager/view/cu menus section to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** EspoCRM version 5.3.6 **Description** A reflected XSS issue exists in the client/res/templates/global-search/name-field.tpl file of EspoCRM, which can be exploited via the `/#Account` endpoint in the search panel. **Recommendations** For EspoCRM version 5.3.6, update to a newer version that contains a fix for this issue, as using outdated versions may pose a security risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EspoCRM version 5.3.6 **Description** A stored XSS issue exists in the views/fields/wysiwyg.js file, which can be exploited via a /#Email/view saved draft message. **Recommendations** For EspoCRM version 5.3.6, consider disabling the wysiwyg editor in the Email view until a patch is available to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** Nucleus CMS (affected versions not specified) **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `title` parameter when adding a new item. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.