Timq

Name of the Vulnerable Software and Affected Versions: CrystalPlayer Pro version 1.98 Description: A buffer overflow issue allows user-assisted remote attackers to execute arbitrary code via a long string in a .mls Playlist file. Recommendations: For CrystalPlayer Pro version 1.98, avoid using .mls Playlist files with long strings until a patch is available. As a temporary workaround, consider restricting the use of .mls files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: A-shop versions 0.70 and earlier Description: A directory traversal issue exists, allowing remote attackers to delete arbitrary files. This is achieved through unspecified filename references in the `delfiles` parameter in the admin/filebrowser.asp file. Recommendations: For A-shop versions 0.70 and earlier, avoid using the `delfiles` parameter in the admin/filebrowser.asp file until a fix is available. Consider restricting access to the admin/filebrowser.asp file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: A-shop versions 0.70 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. Recommendations: For A-shop versions 0.70 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MobilePublisherPHP versions 1.5 RC2 and earlier **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `abspath` parameter. This is a result of a PHP remote file inclusion vulnerability in the `header.php` file. **Recommendations** For MobilePublisherPHP versions 1.5 RC2 and earlier, avoid using the `abspath` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpCOIN version 1.2.3 **Description** The issue allows remote attackers to execute arbitrary PHP code via the ` CCFG[ PKG PATH INCL]` parameter in the `coin includes/constants.php` file. **Recommendations** For phpCOIN version 1.2.3, consider restricting access to the `coin includes/constants.php` file to minimize the risk of exploitation. Avoid using the ` CCFG[ PKG PATH INCL]` parameter in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.