Huliangjia

**Name of the Vulnerable Software and Affected Versions** Cobham SATCOM VSAT7090 Maritime Satellite Router versions prior to 20260704 **Description** Command injection is possible via remote attack in the JSON Parsing component. The issue exists within the `c set reports decode()` function of the `mail-report.sh` file, where improper manipulation of the `sender/recipients` argument allows for the execution of arbitrary commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `c set reports decode()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ICP DAS UA-2200 versions prior to 20260704 ICP DAS UA-5200 versions prior to 20260704 **Description** A remote command injection flaw exists in the `ArmAngstromInstructionSet()` function within the '/CGI?RestApi=SetHostname' endpoint. This issue occurs when the `ParameterArray` argument is manipulated, allowing an attacker to execute arbitrary commands on the system. **Recommendations** Update ICP DAS UA-2200 to a version newer than 20260704. Update ICP DAS UA-5200 to a version newer than 20260704. As a temporary workaround, restrict access to the '/CGI?RestApi=SetHostname' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QVidium Opera11 version 3.3.2a26-Ax4x-opera11 **Description** An unauthenticated command injection issue exists in the CGI Script component. A remote attacker can exploit this by manipulating the `ipaddr` argument within the '/cgi-bin/net tr.cgi' endpoint, allowing for the execution of arbitrary commands on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RedPort Optimizer wXa-203 versions prior to 20260704 RedPort Optimizer wXa-213 versions prior to 20260704 RedPort Optimizer wXa-223 versions prior to 20260704 **Description** A command injection issue exists in the System Clock component. A remote attacker can manipulate the `exec()` function within the `/xgatev1/system/datetime.php` file to execute arbitrary commands on the system. **Recommendations** As a temporary workaround, restrict access to the `/xgatev1/system/datetime.php` file or disable the `exec()` function within that file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Online Food Ordering System version 1.0 **Description** A remote SQL injection is possible due to improper handling of the `Name` argument within the `/fos/admin/ajax.php?action=save settings` endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DeDeCMS version 3 **Description** A flaw in the `/include/dialog/select media post.php` file allows for unrestricted file upload. This occurs when the `uploadfile` argument is manipulated, enabling a remote attacker to upload files to the server. **Recommendations** As a temporary workaround, restrict access to the `/include/dialog/select media post.php` file or disable the functionality associated with the `uploadfile` parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Online Resort Management System version 1.0 **Description** The software is subject to SQL injection in the '/orms/admin/reservations/view details.php' endpoint. SQL injection is a vulnerability that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Resort Management System version 1.0 Description The software is subject to SQL injection in the '/orms/admin/rooms/view room.php' endpoint. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Computer and Mobile Repair Shop Management System version 1.0 **Description** SQL injection is possible in the file '/rsms/admin/inquiries/view details.php'. **Recommendations** As a temporary workaround, restrict access to the file '/rsms/admin/inquiries/view details.php' to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Thesis Archiving System version 1.0 Description The software contains a SQL injection flaw in the '/otas/projects per department.php' endpoint. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage curriculum.php.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Online Thesis Archiving System version 1.0 **Description** The software is subject to SQL injection in the '/otas/view archive.php' file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Computer and Mobile Repair Shop Management System version 1.0 **Description** SQL Injection is possible in the file '/rsms/admin/services/view service.php'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Online Resort Management System version 1.0 **Description** SQL injection is possible in the file '/orms/admin/activities/manage activity.php'. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** As a temporary workaround, consider restricting access to the file '/orms/admin/activities/manage activity.php' until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Computer and Mobile Repair Shop Management System version 1.0 **Description** SQL injection is possible in the file '/rsms/admin/repairs/manage repair.php'. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Computer and Mobile Repair Shop Management System version 1.0 **Description** SQL injection is possible in the file '/rsms/admin/repairs/view details.php'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Computer and Mobile Repair Shop Management System version 1.0 **Description** An SQL injection flaw exists in the file '/rsms/admin/clients/manage client.php'. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sourcecodester Online Resort Management System version 1.0 **Description** SQL Injection exists in the file '/orms/admin/rooms/manage room.php'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.