D3V1L

**Name of the Vulnerable Software and Affected Versions** TSOKA:CMS versions 1.1 through 2.0 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in an "articolo" action in the index.php file. **Recommendations** For TSOKA:CMS versions 1.1 through 2.0, consider restricting access to the index.php file until a patch is available. As a temporary workaround, avoid using the `id` parameter in the articolo action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TSOKA:CMS versions 1.1, 1.9, 2.0 **Description** A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `id` parameter in an "articolo" action. This could potentially lead to unauthorized actions on the affected system. **Recommendations** For TSOKA:CMS version 1.1, update the index.php file to properly sanitize the `id` parameter. For TSOKA:CMS version 1.9, update the index.php file to properly sanitize the `id` parameter. For TSOKA:CMS version 2.0, update the index.php file to properly sanitize the `id` parameter.

**Name of the Vulnerable Software and Affected Versions** vBulletin Radio and TV Player addon (affected versions not specified) **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote registered users to inject arbitrary web script or HTML via the `station` parameter in the `forum/radioandtv.php` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Dew-NewPHPLinks version 2.0 Description: The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `PID` parameter in the "index.php" file. Recommendations: For Dew-NewPHPLinks version 2.0, consider restricting access to the `PID` parameter in the "index.php" file to minimize the risk of exploitation. Avoid using the `PID` parameter until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: JETIK-WEB (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `kat` parameter in the "sayfa.php" file. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TBmnetCMS version 1.0 Description: The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in index.php when magic quotes gpc is disabled. This can be achieved by including a .. (dot dot) in the `content` parameter. Recommendations: For TBmnetCMS version 1.0, consider disabling the `content` parameter in the index.php file until a patch is available, or enable magic quotes gpc to prevent exploitation.

Name of the Vulnerable Software and Affected Versions: Joomla! component com pro desk versions 1.0 through 1.2 Description: A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by including a .. (dot dot) in the `include file` parameter to the "index.php" endpoint. Recommendations: For versions 1.0 through 1.2, consider restricting access to the `include file` parameter in the "index.php" endpoint until a fix is available. As a temporary workaround, avoid using the `include file` parameter with untrusted input.

**Name of the Vulnerable Software and Affected Versions** IndexScript version 3.0 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `parent id` parameter in the sug cat.php file, which is a different attack vector. **Recommendations** For IndexScript version 3.0, consider restricting access to the sug cat.php file until a patch is available. As a temporary workaround, avoid using the `parent id` parameter in the affected file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WSN Links version 2.20 **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `id` parameter in the comments.php file. **Recommendations** For WSN Links version 2.20, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the comments.php file to minimize the risk of exploitation. Avoid using the `id` parameter in the affected comments.php file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WSN Links versions 2.22 through 2.23 WSN Links version 2.34 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `id` parameter in the "vote.php" file. **Recommendations** For WSN Links versions 2.22 through 2.23, and version 2.34, avoid using the `id` parameter in the vote.php file until the issue is resolved. As a temporary workaround, consider restricting access to the vote.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** University of Queensland Library Fez versions 1.3 through 2.0 RC1 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `parent id` parameter in a subject action, specifically targeting the list.php file. **Recommendations** For versions 1.3 through 2.0 RC1, avoid using the `parent id` parameter in the subject action until the issue is resolved. As a temporary workaround, consider restricting access to the list.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PHPKB Knowledge Base Software version 1.5 Professional **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in the ID parameter to API endpoints such as "email.php" and "question.php", specifically through the `ID` parameter. **Recommendations** For PHPKB Knowledge Base Software version 1.5 Professional, as a temporary workaround, consider restricting access to the "email.php" and "question.php" API endpoints until a patch is available. Avoid using the `ID` parameter in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Maran PHP Shop version (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary SQL commands via the `id` parameter in the "prodshow.php" file. This is a different attack vector. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Built2Go Real Estate Listings version 1.5 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the `event id` parameter in the event detail.php file. Recommendations: For Built2Go Real Estate Listings version 1.5, consider restricting access to the event detail.php file until a patch is available, or avoid using the `event id` parameter in this context to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Atomic Photo Album (APA) version 1.1.0pre4 Description: The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `apa album ID` parameter in the album.php file. Recommendations: For Atomic Photo Album (APA) version 1.1.0pre4, avoid using the `apa album ID` parameter in the album.php file until the issue is resolved. As a temporary workaround, consider restricting access to the album.php file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: eSyndiCat (affected versions not specified) Description: The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved via two parameters: the `id` parameter to "news.php" or the `name` parameter to "page.php". Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.