Daniel Compton

**Name of the Vulnerable Software and Affected Versions** X-Cart versions 5.1.6 through 5.1.10 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the `substring` parameter in the "admin.php" file. **Recommendations** For X-Cart versions 5.1.6 through 5.1.10, consider restricting access to the admin.php file until a patch is available. As a temporary workaround, avoid using the `substring` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** X-Cart versions prior to 5.1.11 **Description** The issue allows remote authenticated users to read or delete address data of arbitrary accounts. This can be achieved by sending a modified request to either update or remove address data. **Recommendations** For versions prior to 5.1.11, update to version 5.1.11 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 2.1.x through 2.1.6 Moodle versions 2.2.x through 2.2.3 **Description** A cross-site scripting (XSS) issue exists, allowing remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository. **Recommendations** For Moodle versions 2.1.x through 2.1.6, update to version 2.1.7 or later. For Moodle versions 2.2.x through 2.2.3, update to version 2.2.4 or later.