Catherines77

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** An authenticated attacker can bypass previous fixes for the H2 zip protocol and file dropper. By uploading a zip archive disguised with a .ttf extension via the `FontManage.saveFile` function, the attacker can exploit the zip protocol to achieve remote code execution. **Recommendations** Update to version 2.10.24.

**Name of the Vulnerable Software and Affected Versions** JimuReport versions prior to 2.3.5 **Description** Remote code execution is possible due to improper handling of Aviator expressions. The '/jmreport/executeSelectApi' endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation, allowing attackers to execute arbitrary code. **Recommendations** Update to a version newer than 2.3.4. Restrict access to the '/jmreport/executeSelectApi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** yshopmall versions prior to 1.9.0 **Description** The issue is related to SQL Injection in the image listing interface. **Recommendations** For versions prior to 1.9.0, update to version 1.9.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** sayski ForestBlog version 20241223 **Description** The issue allows a remote attacker to escalate privileges via the article editing function. This is related to a Cross Site Scripting problem. **Recommendations** For sayski ForestBlog version 20241223, consider disabling the article editing function until a patch is available. Restrict access to the editing module to minimize the risk of exploitation.