Amin Isayev

**Name of the Vulnerable Software and Affected Versions** Helix Ultimate (affected versions not specified) **Description** The Joomla extension Helix Ultimate contains a stored Cross-Site Scripting (XSS) flaw that can be exploited by an unauthenticated user. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Helix Ultimate (affected versions not specified) **Description** The Joomla extension Helix Ultimate contains a flaw that allows an unauthenticated user to perform arbitrary file deletion on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SP LMS versions prior to 4.1.4 **Description** SP LMS (com splms) by JoomShaper contains a PHP Object injection flaw where user-controlled cookie data is deserialized without validation. Specifically, the application passes the `lmsOrders` cookie to an unsafe `unserialize()` function before authentication. This allows an unauthenticated remote attacker to trigger a native gadget chain to drop a web shell and execute arbitrary code on the server. **Recommendations** Update to version 4.1.4.