Hlever

**Name of the Vulnerable Software and Affected Versions** marcopiovanello yt-dlp-web-ui versions prior to v5 **Description** Remote command injection is possible through the manipulation of the `params` argument within the `NewGenericDownload()` function located in the server/internal/downloaders/generic.go file. **Recommendations** Apply patch c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 to versions prior to v5.

**Name of the Vulnerable Software and Affected Versions** SveltyCMS version 0.0.6 **Description** Improper access controls exist within the User Attribute Update Endpoint, specifically affecting the file `src/routes/api/[...path]/+server.ts`. This flaw allows a remote attacker to manipulate the system due to insufficient authorization checks. **Recommendations** Apply patch 05b4f9efeb79e9d72a693232334d7529687f896f for version 0.0.6.

**Name of the Vulnerable Software and Affected Versions** SveltyCMS version 0.0.6 **Description** A remote cross site scripting issue exists within the SVG Media Upload component, specifically affecting the `src/utils/media/media-service.server.ts` file. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Apply patch 05b4f9efeb79e9d72a693232334d7529687f896f for version 0.0.6.

**Name of the Vulnerable Software and Affected Versions** SveltyCMS version 0.0.6 **Description** An issue in the File Upload Endpoint component allows for remote server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This is caused by improper processing of the '/mediagallery/upload-media' endpoint. **Recommendations** Apply patch 05b4f9efeb79e9d72a693232334d7529687f896f for version 0.0.6.