Akıner Kisa

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** DoXBASE versions prior to 27082026 **Description** Improper neutralization of input during web page generation leads to a cross-site scripting (XSS) flaw, which allows Cross Zone Scripting. Cross-site scripting is a type of security flaw where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** E-Commerce Pack versions prior to 5.03.01.49 **Description** Improper neutralization of script-related HTML tags in a web page allows Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. **Recommendations** Update E-Commerce Pack to version 5.03.01.49 or later.

**Name of the Vulnerable Software and Affected Versions** E-Commerce Pack versions prior to 5.03.01.49 **Description** A Cross-Site Request Forgery (CSRF) flaw exists in the software. CSRF is a type of attack that tricks a victim into submitting a malicious request. It allows an attacker to perform unauthorized actions on behalf of an authenticated user. **Recommendations** Update to version 5.03.01.49 or later.

**Name of the Vulnerable Software and Affected Versions** AVESİS versions prior to 202606251646 **Description** An issue exists where external control of an assumed-immutable web parameter allows access to functionality that is not properly constrained by Access Control Lists (ACLs), which are security mechanisms used to define which users or systems are granted access to specific resources. **Recommendations** Update AVESİS to version 202606251646 or later.

**Name of the Vulnerable Software and Affected Versions** Liman MYS versions prior to release.Master.1107 **Description** A missing authorization issue allows access to functionality that is not properly constrained by Access Control Lists (ACLs), which are sets of rules that define which users or system processes are granted access to objects in an environment. **Recommendations** Update Liman MYS to version release.Master.1107 or later.

**Name of the Vulnerable Software and Affected Versions** Liman MYS versions prior to release.Master.1107 **Description** Improper verification of cryptographic signatures allows an attacker to fake the source of data. **Recommendations** Update Liman MYS to version release.Master.1107 or later.

**Name of the Vulnerable Software and Affected Versions** AKIN Software Computer Import Export Industry and Trade Ltd. E-Commerce versions prior to 1.25.01.06 **Description** Improper neutralization of input during web page generation allows Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the victim's browser. **Recommendations** Update to version 1.25.01.06 or later.

**Name of the Vulnerable Software and Affected Versions** WISECP versions prior to 20022026 **Description** Cross-Site Request Forgery (CSRF) allows an attacker to induce a user to perform actions they did not intend to do by tricking their browser into sending a forged request to the application. **Recommendations** Update to a version later than 20022026.

**Name of the Vulnerable Software and Affected Versions** Dayneks Software Industry and Trade Inc. E-Commerce Platform versions through 27022026 **Description** The Dayneks Software Industry and Trade Inc. E-Commerce Platform is affected by an Improper Neutralization of Special Elements used in an SQL Command issue, also known as SQL Injection. This allows for the execution of malicious SQL commands when an attacker inserts unsanitized SQL code into input fields. The vendor was contacted regarding this issue but did not respond. **Recommendations** Versions through 27022026 should be updated when a fixed version is available. As a temporary workaround, implement robust input validation and sanitization for all user-supplied data used in SQL queries.

**Name of the Vulnerable Software and Affected Versions** Proliz Software Ltd. OBS (Student Affairs Information System) versions prior to 26.5009 **Description** The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting (XSS) condition. This allows for the execution of malicious scripts within the context of a user's browser. The vulnerability exists in the way the application handles user-supplied data when constructing web pages. The vulnerable component is susceptible to injection of malicious code through crafted input. **Recommendations** Update to version 26.5009 or later.

**Name of the Vulnerable Software and Affected Versions** TalentSoft Software UNIS versions prior to 42321 **Description** A flaw exists in TalentSoft Software UNIS related to the improper handling of special characters within SQL queries, potentially allowing for SQL Injection. This issue could allow an attacker to manipulate database queries, potentially leading to unauthorized access, data modification, or disclosure. **Recommendations** Update TalentSoft Software UNIS to version 42321 or later.

**Name of the Vulnerable Software and Affected Versions** Proliz Software Ltd. Co. OBS (Student Affairs Information System) versions prior to V26.0401 **Description** A flaw exists in Proliz Software Ltd. Co. OBS (Student Affairs Information System) that allows for Reflected Cross-site Scripting (XSS). This issue arises from improper neutralization of input during web page generation. The vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Proliz Software Ltd. Co. OBS (Student Affairs Information System) to version V26.0401 or later.

**Name of the Vulnerable Software and Affected Versions** Vizly Web Design Real Estate Packages versions prior to 5.1 **Description** The software contains an Improper Neutralization of Input During Web Page Generation vulnerability, also known as Cross-site Scripting (XSS). This issue allows for Content Spoofing and may lead to Session Hijacking. **Recommendations** Update Vizly Web Design Real Estate Packages to version 5.1 or later.