B4Zb0Z

Name of the Vulnerable Software and Affected Versions: Rafed CMS Website version 1.44 Description: A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For Rafed CMS Website version 1.44, consider disabling the index.php component until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using crafted payloads in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to Cross Site Scripting (XSS), which is a type of security vulnerability that can be exploited by attackers to inject malicious scripts into websites. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows unauthenticated attackers to arbitrarily create or update user accounts due to a problem in the save users() function.

An issue in the `delete post()` function allows unauthenticated attackers to arbitrarily delete posts.

A cross-site scripting issue in the ads comment section allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

A reflected cross-site scripting (XSS) issue was found in the User Upgrade Form. This could potentially allow attackers to inject malicious scripts into the website, affecting users who interact with the compromised form.

A cross-site scripting issue in the DM Section component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

A stored cross-site scripting (XSS) issue was found in the Post Ads component. This allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized actions or data theft.

The issue concerns a SQL Injection vulnerability. It can be exploited via the "accounts/payment history.php" endpoint, specifically at line 31.

The issue concerns SQL Injection, which can be exploited via the "reports/daily collection report.php" endpoint. Specifically, the vulnerability is located at line 59 of this file.

The issue concerns SQL Injection, which can be exploited via the "accounts/view details.php" endpoint. Specifically, the vulnerability is located at line 4 of this file.

The issue is related to reflected cross-site scripting (XSS) in the admin/inc/navigation.php file at line 125. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the user's browser.

The issue is related to reflected cross-site scripting (XSS) in the School Dormitory Management System. This occurs via the `admin/inc/navigation.php` file at line 126. Reflected XSS is a type of attack where an attacker injects malicious code into a website, and the website reflects it back to the user, potentially executing the malicious code.

A reflected cross-site scripting (XSS) issue was found in the Admin panel. The vulnerability is exploited via the `page` parameter in the $ GET request. This allows an attacker to inject malicious scripts into the webpage, potentially leading to unauthorized actions or data theft.

A reflected cross-site scripting (XSS) issue was found in the Admin panel of Home Owners Collection Management. The vulnerability is exploited via the `$ GET['s']` parameter.