Dwmm

**Name of the Vulnerable Software and Affected Versions** DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version 2.0.0-beta1 **Description** Remote SQL injection is possible within the Timesheet Dashboard component. The issue exists in the `whereRaw()` function located in the `app/Filament/Widgets/Timesheet/ActivitiesReport.php` file, where manipulating the `filter` argument allows for the execution of arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Timesheet Dashboard component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version v2.0.0-beta1 **Description** A remote SQL injection exists in the Timesheet Dashboard component within the `whereRaw()` function of the `app/Filament/Widgets/Timesheet/MonthlyReport.php` file. This issue occurs when the `filter` argument is manipulated, allowing an attacker to execute unauthorized SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Timesheet Dashboard component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version v2.0.0-beta1 **Description** In the Jira Import component, the `updateJiraProjects()` function within the `/jira-import` file is susceptible to server-side request forgery (SSRF), a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. This can be triggered remotely by manipulating the `host`, `username`, or `token` arguments. **Recommendations** As a temporary workaround, restrict access to the `/jira-import` file or disable the `updateJiraProjects()` function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Yot CMS versions prior to 3.3.2 **Description** A remote SQL injection exists within the Cookie Handler component. The issue occurs in the `Login()` function located in the global.php file when processing the `yot3 user` and `yot3 pass` arguments. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** Update Yot CMS to version 3.3.2 or later. As a temporary workaround, restrict access to the `Login()` function in the global.php file.

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.