Chapochapo

**Name of the Vulnerable Software and Affected Versions** Tag plugin for GLPI 11 versions prior to 2.14.4 **Description** Stored cross-site scripting occurs because the software stores tag names without HTML sanitization and renders them into the Kanban badge markup via the `preKanbanContent()` function without output escaping. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project associated with that tag. **Recommendations** Update Tag plugin for GLPI 11 to version 2.14.4 or later.

**Name of the Vulnerable Software and Affected Versions** SunFounder Pironman Dashboard (pm dashboard) versions prior to 1.3.13 **Description** The SunFounder Pironman Dashboard (pm dashboard) contains a path traversal flaw in the log file API endpoints. An unauthenticated remote attacker can manipulate the `filename` parameter with traversal sequences to read and delete arbitrary files. Successful exploitation could lead to the disclosure of sensitive information and the deletion of critical system files, potentially resulting in data loss, system compromise, or denial of service. The API endpoints involved are susceptible to this issue. **Recommendations** Versions prior to 1.3.13 should be updated.