Ferit Özner

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Dayneks Software Industry and Trade Inc. E-Commerce Platform versions prior to 28082026 **Description** Improper neutralization of input during web page generation allows Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the victim's browser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BiEticaret versions prior to 3.3.57 **Description** Improper neutralization of input during web page generation allows Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the victim's browser. **Recommendations** Update BiEticaret to version 3.3.57 or later.

**Name of the Vulnerable Software and Affected Versions** BiEticaret versions prior to 3.3.57 **Description** Improper neutralization of special elements used in an SQL command allows for SQL injection. This occurs when the application fails to properly sanitize user-supplied data before incorporating it into a database query, potentially allowing an attacker to manipulate the query logic. **Recommendations** Update BiEticaret to version 3.3.57 or later.

**Name of the Vulnerable Software and Affected Versions** Related Marketing Cloud (RMC) versions prior to 12052026 **Description** An authentication bypass by spoofing issue in Hedef Media Promotion Interactive Media Marketing Inc. Related Marketing Cloud (RMC) allows for brute force attacks. **Recommendations** Update to a version later than 12052026.

**Name of the Vulnerable Software and Affected Versions** E-Commerce Website versions prior to 4.5.001 **Description** An authorization bypass exists due to a user-controlled key, which allows for session hijacking. This is an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input. **Recommendations** Update to version 4.5.001 or later.

**Name of the Vulnerable Software and Affected Versions** Proticaret E-Commerce versions 5.0.0 through 6.0.1767.1382 **Description** Improper neutralization of input during web page generation allows for Reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation or escaping, enabling attackers to execute malicious scripts in the victim's browser. **Recommendations** Update Proticaret E-Commerce to version 6.0.1767.1383.

**Name of the Vulnerable Software and Affected Versions** Dokuzsoft Technology Ltd. E-Commerce Product versions through 10122025 **Description** The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a Reflected Cross-site Scripting (XSS) condition. The issue allows for the execution of malicious scripts through web pages. The vulnerable product is developed by Dokuzsoft Technology Ltd.Şti. **Recommendations** Versions prior to 10122025 should be updated.

**Name of the Vulnerable Software and Affected Versions** Perfektive versions prior to 12574 Build 2701 **Description** The software exhibits issues related to improper restriction of excessive authentication attempts, client-side enforcement of server-side security, and reliance on untrusted inputs in a security decision. This can lead to brute force attacks, authentication bypass, and functionality bypass. The issue is associated with CWE-307, CWE-602, and CWE-807. **Recommendations** Update Perfektive to version 12574 Build 2701 or later.