Biantaibao

**Name of the Vulnerable Software and Affected Versions** hongmaple octopus version 1.0 **Description** A critical issue has been found in the software, affecting an unknown function of the file /system/dept/edit. The manipulation of the `ancestors` argument leads to SQL injection. This issue can be exploited remotely. The exploit has been disclosed publicly. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** hongmaple octopus version 1.0 **Description** A vulnerability was found in hongmaple octopus, affecting an unknown functionality. The manipulation of the argument `description` with the input `<script>alert(document.cookie)</script>` leads to cross-site scripting. The attack can be launched remotely. **Recommendations** For version 1.0, as a temporary workaround, consider restricting the input for the `description` argument to minimize the risk of cross-site scripting exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** qwdigital LinkWechat version 5.1.0 **Description** A vulnerability was found in qwdigital LinkWechat, affecting an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation of the `name` argument with the input `/profile/../../../../../etc/passwd` leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For qwdigital LinkWechat version 5.1.0, as a temporary workaround, consider restricting access to the `/linkwechat-api/common/download/resource` endpoint until a patch is available. Avoid using the `name` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** hongmaple octopus version 1.0 biantaibao octopus version 1.0 **Description** A critical issue has been found, affecting an unknown function of the file /system/role/list. The manipulation of the `dataScope` argument leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For hongmaple octopus version 1.0, as a temporary workaround, consider restricting access to the /system/role/list file until a fix is available. For biantaibao octopus version 1.0, as a temporary workaround, consider restricting access to the /system/role/list file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** liuwy-dlsdys zhglxt version 4.7.7 **Description** A problematic issue has been found in the HTTP POST Request Handler component, affecting the processing of the file /oa/notify/edit. The manipulation of the `notifyTitle` argument leads to cross-site scripting. The attack can be initiated remotely. **Recommendations** For version 4.7.7, consider disabling the `notifyTitle` argument in the HTTP POST Request Handler until a patch is available. Restrict access to the /oa/notify/edit file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mldong version 1.0 **Description** A critical issue has been found in mldong, affecting the `ExpressionEngine` function of the file `com/mldong/modules/wf/engine/model/DecisionModel.java`. This issue leads to code injection and can be initiated remotely. The exploit has been disclosed to the public. **Recommendations** For version 1.0, consider disabling the `ExpressionEngine` function until a patch is available to prevent code injection attacks. Restrict access to the `com/mldong/modules/wf/engine/model/DecisionModel.java` file to minimize the risk of exploitation. Avoid using the `DecisionModel.java` file in remote operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ZhongFuCheng3y Austin version 1.0 **Description** A critical issue affects the function `getRemoteUrl2File` of the file `srcmainjavacomjava3yaustinsupportutilsAustinFileUtils.java` in the Email Message Template Handler component. This issue is related to insufficient validation of incoming requests and leads to server-side request forgery. The attack can be launched remotely, and the exploit has been disclosed to the public. **Recommendations** As a temporary workaround, consider disabling the `getRemoteUrl2File` function until a patch is available. Restrict access to the `AustinFileUtils.java` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ZhongFuCheng3y Austin version 1.0 **Description** A critical issue affects the `getFile` function of the `MaterialController.java` file in the Upload Material Menu component, leading to unrestricted upload. The exploit has been disclosed to the public and may be used. **Recommendations** For ZhongFuCheng3y Austin version 1.0, as a temporary workaround, consider disabling the `getFile` function until a patch is available. Restrict access to the Upload Material Menu component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Purchase Order Management System version 1.0 **Description** A problematic issue has been found in the system, affecting an unknown part of the file classes/Master.php?f=save item. The manipulation of the `description` argument with the input `<script>alert(document.cookie)</script>` leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For SourceCodester Purchase Order Management System version 1.0, consider disabling the `save item` function in the Master.php file until a patch is available. Restrict access to the classes/Master.php file to minimize the risk of exploitation. Avoid using the `description` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.