Jidle

**Nome do Software Vulnerável e Versões Afetadas** OpenClaw versões anteriores a 2026.6.5 **Description** Existe uma falha de bypass de autenticação em respostas HTTP Canvas. Esta falha permite que chamadores de menor confiança forjem ações A2UI (Application-to-UI) confiáveis, permitindo que atacantes executem operações que exigem autorização mais forte ao enviar solicitações manipuladas através de caminhos de entrada configurados, ignorando as verificações de política pretendidas. **Recommendations** Atualize o OpenClaw para a versão 2026.6.5 ou posterior.

**Name of the Vulnerable Software and Affected Versions** SMTP Mailing Queue WordPress plugin versions prior to 2.0.1 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example, in a multisite setup. **Recommendations** For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Moosikay E-Commerce System version 1.0 **Description** A critical issue affects the file /Moosikay/order.php of the component POST Parameter Handler. The manipulation of the `username` argument leads to sql injection. The attack may be launched remotely. **Recommendations** For version 1.0, consider disabling the `username` argument in the /Moosikay/order.php file until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Online Boat Reservation System version 1.0 **Description** A vulnerability has been found in the file /boat/login.php of the component POST Parameter Handler. The manipulation of the argument `un` leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For SourceCodester Online Boat Reservation System version 1.0, consider disabling the `un` argument in the /boat/login.php file as a temporary workaround until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the `un` argument in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SeaCMS version 11.6 **Description** A problematic issue was found in the Picture Management component, specifically affecting some unknown functionality of the file /data/config.ftp.php. This issue leads to deserialization and can be exploited remotely. **Recommendations** For SeaCMS version 11.6, consider restricting access to the /data/config.ftp.php file until a patch is available. As a temporary workaround, avoid using the Picture Management component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.