Db

**Name of the Vulnerable Software and Affected Versions** My Little Forum versions 1.75 through 2.0 Beta 23 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via BBcode `IMG` tags, which can lead to cross-site scripting (XSS) attacks. **Recommendations** For My Little Forum versions 1.75 through 2.0 Beta 23, consider disabling the use of BBcode `IMG` tags until a patch is available to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** netOffice Dwins version 1.3 p2 **Description** The issue allows remote attackers to bypass authentication and execute arbitrary code. This is possible because the `demoSession` variable is compared to the 'true' string literal instead of the true boolean literal. Attackers can exploit this by setting the `demoSession` variable to 1, for example, by uploading a PHP script via an action to "projects site/uploadfile.php". **Recommendations** For netOffice Dwins version 1.3 p2, consider modifying the comparison of the `demoSession` variable to use the true boolean literal instead of the 'true' string literal to prevent authentication bypass. As a temporary workaround, restrict access to the "projects site/uploadfile.php" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ImageAlbum version 2.0.0b2 **Description** The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. This is caused by improper handling of the `id` parameter in various classes, including (1) classes/IADomain.php, (2) classes/IACollection.php, and (3) classes/IAUser.php. An example of exploitation is via the `id` parameter in a "collection.imageview" action. **Recommendations** For ImageAlbum version 2.0.0b2, consider restricting access to the `id` parameter in the affected classes until a patch is available. As a temporary workaround, avoid using the `id` parameter in sensitive actions, such as collection.imageview, to minimize the risk of exploitation.