Abdullah Kala

**Name of the Vulnerable Software and Affected Versions** Projectsend version r1295 **Description** An authenticated attacker can inject malicious scripts by submitting crafted input through the `name` parameter in the 'files-edit.php' endpoint. These JavaScript payloads execute in the browser of other users, specifically targeting System Administrator users on the Dashboard page, when the file is viewed. This is a stored cross-site scripting issue, where a script is permanently stored on the server and served to other users. **Recommendations** As a temporary workaround, restrict access to the 'files-edit.php' endpoint or avoid using the `name` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Glox Technology Useroam Hotspot versions prior to 5.1.0.15 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions prior to 5.1.0.15, update to version 5.1.0.15 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive database queries until a patch is applied. Avoid using user-supplied input in SQL commands without proper sanitization.