Endy

**Name of the Vulnerable Software and Affected Versions** Paid Videochat Turnkey Site versions 7.4.8 and earlier **Description** An issue exists that allows a performer to perform arbitrary file deletion within the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS versions prior to 3.7.28 **Description** Cross Site Scripting (XSS) exists in the subscriber role, allowing an attacker to execute malicious scripts in the browser of other users. **Recommendations** Update MasterStudy LMS to version 3.7.28 or later.

**Name of the Vulnerable Software and Affected Versions** Panorama Viewer – 360 Degree Image + Video Viewer versions prior to 1.6.2 **Description** The Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More plugin for WordPress allows authenticated attackers with contributor-level access or higher to perform Local File Inclusion (LFI). LFI is a vulnerability that allows an attacker to include files from the local server. This flaw enables the execution of arbitrary files on the server, which can lead to the execution of PHP code, bypassing access controls, and the retrieval of sensitive data, particularly when images or other safe file types are uploaded and then included. **Recommendations** Update the plugin to a version newer than 1.6.1.

**Name of the Vulnerable Software and Affected Versions** SALESmanago & Leadoo versions prior to 3.11.3 **Description** The SALESmanago & Leadoo plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and a lack of proper preparation in SQL queries allow authenticated attackers with subscriber-level access or higher to perform SQL Injection. This enables the execution of additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 3.11.2.

**Name of the Vulnerable Software and Affected Versions** StylemixThemes Motors versions prior to 1.4.109 **Description** Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion) allows PHP Local File Inclusion. This occurs when the application does not properly validate the filename used in include or require statements, potentially allowing an attacker to include files from the local system. **Recommendations** Update to a version later than 1.4.109.

**Name of the Vulnerable Software and Affected Versions** StylemixThemes Motors versions prior to 1.4.109 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update to a version newer than 1.4.109.

**Name of the Vulnerable Software and Affected Versions** Active Products Tables for WooCommerce versions prior to 1.0.9 **Description** An issue exists due to improper neutralization of special elements used in an SQL command, leading to Blind SQL Injection. This occurs because of insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update Active Products Tables for WooCommerce to a version newer than 1.0.8.