Abdulaziz Saad

Name of the Vulnerable Software and Affected Versions: Rafed CMS Website version 1.44 Description: A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For Rafed CMS Website version 1.44, consider disabling the index.php component until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using crafted payloads in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue in the `delete post()` function allows unauthenticated attackers to arbitrarily delete posts.

The issue allows unauthenticated attackers to arbitrarily create or update user accounts due to a problem in the save users() function.

A cross-site scripting issue in the ads comment section allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

A reflected cross-site scripting (XSS) issue was found in the User Upgrade Form. This could potentially allow attackers to inject malicious scripts into the website, affecting users who interact with the compromised form.

A cross-site scripting issue in the DM Section component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

A stored cross-site scripting (XSS) issue was found in the Post Ads component. This allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized actions or data theft.

The issue concerns SQL Injection, which can be exploited via the "reports/daily collection report.php" endpoint. Specifically, the vulnerability is located at line 59 of this file.

The issue concerns a SQL Injection vulnerability. It can be exploited via the "accounts/payment history.php" endpoint, specifically at line 31.

The issue is related to reflected cross-site scripting (XSS) in the admin/inc/navigation.php file at line 125. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the user's browser.

A reflected cross-site scripting (XSS) issue was found in the Admin panel. The vulnerability is exploited via the `page` parameter in the $ GET request. This allows an attacker to inject malicious scripts into the webpage, potentially leading to unauthorized actions or data theft.

A reflected cross-site scripting (XSS) issue was found in the Admin panel of Home Owners Collection Management. The vulnerability is exploited via the `$ GET['s']` parameter.