0N1On

**Name of the Vulnerable Software and Affected Versions** java110 MicroCommunity versions prior to 2.1 **Description** Remote manipulation of the `fallBackSql` argument within the `QueryServiceSMOImpl.fallBack()` function of the `BusinessApi.java` file in the fallBack API endpoint allows for SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the fallBack API endpoint or avoid using the `fallBackSql` parameter until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MantisZip versions prior to 0.4.6 **Description** A path traversal flaw exists in the Preview component within the `MainWindow.UI.cs` file. The issue occurs in the `Path.Combine()` function, allowing a remote attacker to manipulate file paths to access unauthorized directories. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ShopXO versions prior to 2.2.8 **Description** A path traversal issue exists in the Ueditor Upload Interface component within the `config/ueditor.php` file. A remote attacker can exploit this by manipulating the `path type` argument, allowing them to access files or directories outside the intended folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.