Eddie Zhang

**Name of the Vulnerable Software and Affected Versions** PHPIPAM (affected versions not specified) **Description** An authenticated local file inclusion issue exists that allows users with API access to execute or include arbitrary PHP files located on the web server's file system. Local File Inclusion (LFI) is a flaw that allows an attacker to read or execute files on the server. The API is not enabled by default in standard installations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** myVesta (affected versions not specified) **Description** An authenticated remote code execution issue exists where low privileged users can execute arbitrary commands. This occurs when deleting FTP usernames by inserting commands into the `v ftp user` parameter. Successful exploitation may allow an attacker to execute commands as the admin user or completely take over the admin account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HTTP File Server version 1.4.1 **Description** The issue is related to a path traversal vulnerability that allows for arbitrary directory listing, file read, and file write. This is due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may permit a remote attacker to read, modify, or delete files. **Recommendations** For version 1.4.1, consider restricting access to sensitive directories and files as a temporary workaround until a patch is available. Avoid using the application for sensitive file storage or transfer until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.