Akinlabi Omoogun

**Name of the Vulnerable Software and Affected Versions** iCagenda versions 4.0.8 through 4.0.12 **Description** The frontend Submit an Event form allows authenticated users to perform a Stored Cross-Site Scripting (XSS) attack. This occurs because the `image` and `file` fields are stored as raw strings without proper output-side HTML-attribute escaping. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Balbooa Forms versions prior to 2.4.3.2 **Description** An issue exists where the 'stripeCharges' and 'payAuthorize' endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it based on the configured product prices. Additionally, these endpoints do not enforce authentication or Cross-Site Request Forgery (CSRF) checks. This allows an unauthenticated attacker to purchase priced items for an arbitrary amount and forge line items, quantities, and shipping details. **Recommendations** Update Balbooa Forms to version 2.4.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Balbooa Forms versions prior to 2.4.3.2 **Description** An unauthenticated attacker can perform PHP code injection due to the use of the `eval()` function in the optional custom-PHP post-submission handler. The `[URL parameter = X]` shortcode is replaced with the raw, unescaped value of a query parameter, allowing arbitrary PHP code to execute on the server. Although a CSRF (Cross-Site Request Forgery) token is required to access the endpoint, it is disclosed anonymously through a separate task. This issue is exploitable if the form has a custom-PHP handler configured that references the shortcode and does not use reCAPTCHA on the submit button. **Recommendations** Update to version 2.4.3.2 or later. As a temporary mitigation, disable the custom-PHP post-submission handler or implement reCAPTCHA on the submit button.