Hubdk01

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1 20251110. This affects the function basicstation apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4 20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1 20251110. This vulnerability affects the function nodered lib apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4 20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

**Name of the Vulnerable Software and Affected Versions** kishan0725 Hospital-Management-System version 1.0 **Description** A security flaw allows remote attackers to perform SQL injection, a technique used to interfere with the queries that an application makes to its database. The issue exists in the `/search.php` endpoint when manipulating the `Contact` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `/search.php` endpoint or avoid using the `Contact` variable until a fix is provided.

**Name of the Vulnerable Software and Affected Versions** ShopEx ECShop versions prior to 2.5.2 **Description** A weakness in the `check img type()` function within the `admin/pack.php` file allows for unrestricted file upload. A remote attacker can exploit this by manipulating the `pack img` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `admin/pack.php` file or disable the `check img type()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ShopEx ECShop versions prior to 2.5.2 **Description** A remote SQL injection exists in the `flow update cart()` function within the '/flow.php?step=update cart' endpoint. This issue occurs when the `rec id` variable is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/flow.php?step=update cart' endpoint or avoid using the `rec id` parameter until a patch is available.

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

**Name of the Vulnerable Software and Affected Versions** DeDeCMS version 53 1 UTF8 **Description** Remote attackers can perform a SQL injection by manipulating the `sql` argument within the '/plus/advancedsearch.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Avoid using the `sql` parameter in the '/plus/advancedsearch.php' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Online Food Ordering System version 1.0 **Description** A remote SQL injection exists in the `/fos/admin/view order.php` endpoint. The issue occurs when the `ID` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** Update SourceCodester Simple Online Food Ordering System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/fos/admin/view order.php` file.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Online Reviewer System version 1.0 **Description** SQL Injection is possible in the file '/system/system/admins/assessments/examproper/exam-update.php'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Cab Management System version 1.0 **Description** SQL Injection is possible in the file '/cms/admin/bookings/view booking.php'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.