Dtwin

**Name of the Vulnerable Software and Affected Versions** dazhouda lecms version 3.0.3 **Description** A vulnerability has been found in dazhouda lecms, affecting an unknown part of the file "/index.php?my-profile-ajax-1" of the component Personal Information Page. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For dazhouda lecms version 3.0.3, consider disabling access to the "/index.php?my-profile-ajax-1" endpoint until a patch is available. Restrict access to the Personal Information Page component to minimize the risk of exploitation. Avoid using the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dazhouda lecms version 3.0.3 **Description** A vulnerability was found in the software, which has been rated as problematic. It affects some unknown functionality of the file admin/view/default/user set.htm, leading to information disclosure. The attack may be launched remotely. **Recommendations** For dazhouda lecms version 3.0.3, consider restricting access to the file admin/view/default/user set.htm to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dazhouda lecms version 3.0.3 **Description** A problematic issue has been found in the Password Change Handler component, affecting the /index.php?my-password-ajax-1 file. This leads to cross-site request forgery and can be initiated remotely. The exploit has been publicly disclosed. **Recommendations** For dazhouda lecms version 3.0.3, consider disabling the `my-password-ajax-1` functionality in the Password Change Handler component until a patch is available. Restrict access to the `/index.php?my-password-ajax-1` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dazhouda lecms versions up to 3.0.3 **Description** A problematic issue has been found in the affected software, impacting some unknown functionality of the file `/admin` of the component Edit Profile Handler. This issue leads to cross site scripting and can be exploited remotely. The exploit has been disclosed to the public. **Recommendations** For versions up to 3.0.3, consider disabling the Edit Profile Handler component until a patch is available. Restrict access to the `/admin` file to minimize the risk of exploitation. Avoid using the affected functionality of the Edit Profile Handler component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** caipeichao ThinkOX version 1.0 **Description** A problematic vulnerability has been found in the Search component of the software. The issue is related to the manipulation of the `keywords` argument, which leads to cross-site scripting. This can be initiated remotely. The exploit has been disclosed publicly. **Recommendations** For version 1.0, consider restricting access to the `/ThinkOX-master/index.php?s=/Weibo/Index/search.html` endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `keywords` argument in the affected Search component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.