Bekzod Tursunov

**Name of the Vulnerable Software and Affected Versions** duhow/xiaoai-patch versions prior to commit fb07049 **Description** An OS command injection flaw allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers. The issue occurs because the `/mute` and `/unmute` endpoints in `api/main.py` pass the `silent` query parameter directly to the `os.system()` function without proper sanitization, allowing the use of shell metacharacters to inject commands. **Recommendations** Update duhow/xiaoai-patch to a version beyond commit fb07049. Avoid using the `silent` parameter in the `/mute` and `/unmute` endpoints until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** duhow/xiaoai-patch versions prior to commit fb07049 **Description** A server-side request forgery (SSRF) issue allows a remote attacker to force a Xiaomi smart speaker to perform HTTP requests to arbitrary internal or external URLs. This occurs because the '/auth' endpoint in `api/main.py` uses the `url` POST parameter to redirect to a Home Assistant instance without validating the destination URL, which can be used for internal network scanning and accessing internal services. **Recommendations** Update duhow/xiaoai-patch to a version beyond commit fb07049. As a temporary mitigation, restrict access to the '/auth' endpoint to prevent unauthorized requests.

**Name of the Vulnerable Software and Affected Versions** dulldusk/phpfm versions prior to 1.8.1 **Description** An unrestricted file upload issue allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application is configured by default with an empty upload extension filter `upload ext filter` and no authentication enabled via the `auth pass` variable. This allows an attacker to upload a PHP webshell and execute it by accessing the uploaded file path. **Recommendations** Update dulldusk/phpfm to a version later than 1.8.0. Configure the `upload ext filter` to restrict allowed file extensions. Set a strong password for the `auth pass` variable to enable authentication.

**Name of the Vulnerable Software and Affected Versions** dulldusk/phpfm versions prior to 1.8.1 **Description** A missing authentication flaw allows an unauthenticated remote attacker to access the full file manager functionality. This enables the reading, writing, deleting, and uploading of files anywhere on the server filesystem. The issue occurs because the authentication check in the `index.php` file evaluates the condition `if ($auth pass == '' || $loggedon==$auth pass)`. In the default configuration, `auth pass` is an empty string, causing the condition to always evaluate to true and grant full access without credentials. **Recommendations** Update dulldusk/phpfm to a version newer than 1.8.0.

**Name of the Vulnerable Software and Affected Versions** ember-dynamic-render-template (affected versions not specified) **Description** The render-template component in `addon/components/render-template.js` passes the `templateString` property directly into the `compileTemplate()` function from `@ember/template-compilation` without sanitization, allow-listing, or validation. Since `compileTemplate()` dynamically compiles and renders the string as a live Handlebars/Glimmer template, applications rendering attacker-influenced data through this property are susceptible to client-side template injection. This allows an attacker-controlled Handlebars expression to be executed in the context of the rendering component, potentially leading to cross-site scripting (XSS) depending on the available helpers and context. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.