Cnluminous

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Common/Conf/config.php of the component Debug Mode. The manipulation of the argument DB DEBUG results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** A remote SQL injection is possible due to improper manipulation of the `field name` argument within the `Notes controller::search scratch data()` function located in the application/PHP/objects/notes/search scratch data.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** As a temporary workaround, consider restricting the use of the `field name` argument in the `Notes controller::search scratch data()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** A remote cross-site scripting issue exists due to improper manipulation of the argument reference within the `add definition()` function located in the application/PHP/objects/notes/add into dictionary.php file. **Recommendations** As a temporary workaround, consider restricting the use of the `add definition()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy (affected versions not specified) **Description** An unrestricted file upload issue exists in the file 'application/PHP/objects/updates/add post.php'. A remote attacker can initiate an attack by manipulating the `up file to post` argument, allowing the upload of unauthorized files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.