Evan Nr

**Name of the Vulnerable Software and Affected Versions** iNET Webkit version 1.2.4 **Description** A SQL Injection issue exists that allows users with Contributor privileges to execute arbitrary SQL commands on the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Search Atlas SEO versions prior to 2.6.7 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Search Atlas SEO to version 2.6.7 or later.

**Name of the Vulnerable Software and Affected Versions** WPAdverts versions prior to 2.3.2 **Description** The WPAdverts – Classifieds Plugin for WordPress contains a stored Cross-Site Scripting (XSS) flaw. This occurs because the plugin fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page. **Recommendations** Update the plugin to a version newer than 2.3.1.

**Name of the Vulnerable Software and Affected Versions** Wallet System for WooCommerce versions prior to 2.7.7 **Description** Broken access control allows users with the Subscriber role to perform unauthorized actions within the system. **Recommendations** Update Wallet System for WooCommerce to version 2.7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Easy Elements for Elementor – Addons & Website Templates versions prior to 1.5.0 **Description** An unauthenticated privilege escalation issue exists, allowing an attacker to gain higher-level permissions without providing valid credentials. **Recommendations** Update Easy Elements for Elementor – Addons & Website Templates to version 1.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Listdom versions prior to 5.4.0 **Description** Improper Neutralization of Special Elements used in an SQL Command allows Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update to a version newer than 5.4.0.

**Name of the Vulnerable Software and Affected Versions** Really Simple SSL versions prior to 9.6.0 **Description** Broken Access Control allows users with the Subscriber role to perform unauthorized actions. **Recommendations** Update to a version newer than 9.5.9.

**Name of the Vulnerable Software and Affected Versions** Five Star Restaurant Reservations versions prior to 2.7.15 **Description** Missing authorization in Etoile Web Design Incorporated Five Star Restaurant Reservations allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version newer than 2.7.14.

**Name of the Vulnerable Software and Affected Versions** EventPrime versions prior to 4.3.2.0 **Description** Missing authorization allows the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version newer than 4.3.2.0.

**Name of the Vulnerable Software and Affected Versions** e4jvikwp VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9 **Description** Improper neutralization of input during web page generation allows DOM-Based Cross-Site Scripting (XSS), a flaw where the application contains client-side scripts that execute malicious code in the user's browser due to unsafe handling of data. **Recommendations** Update to a version later than 1.8.8.

**Name of the Vulnerable Software and Affected Versions** Paolo GeoDirectory versions prior to 2.8.158 **Description** Missing authorization allows the exploitation of incorrectly configured access control security levels. **Recommendations** Update Paolo GeoDirectory to version 2.8.158 or later.