Dest1Ny_2

A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kd cs leads to authorization bypass. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Akpali9 Attendance-Management-System versions up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee **Description** Remote cross site scripting occurs due to improper processing of the `absent.php` file. An attacker can initiate the attack by manipulating the `export date` argument. **Recommendations** Avoid using the `export date` argument in the `absent.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sergomanov SmartHomeAdatum versions up to cf495353d81b680675eb8d9aa14a318aa45ce12c **Description** A remote SQL injection is possible within the Login component in the `users.php` file. The issue occurs when the `Login` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** As a temporary mitigation, restrict access to the `users.php` file or the Login component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AojiaoZero Antaris version 1.0 **Description** A SQL injection issue exists in the PayPal IPN Payment Handler component within the `/ipn.php` file. A remote attacker can exploit this by manipulating the `item number` argument passed to the ` rewardPurchase()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/ipn.php` file or the ` rewardPurchase()` function to minimize the risk of exploitation.