Ikram-4

**Name of the Vulnerable Software and Affected Versions** simple-php-router versions prior to 5.4.1.8 **Description** The `IpRestrictAccess` middleware contains a flaw that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. By spoofing the `X-Forwarded-For`, `CF-Connecting-IP`, or `Client-IP` headers, an attacker can impersonate whitelisted addresses or evade blacklists to gain unauthorized access to IP-restricted routes. **Recommendations** Update simple-php-router to version 5.4.1.8 or later.

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.

Marmite through 0.4.2 contains missing authentication in the development server endpoints / marmite /content, / marmite /config, and / marmite /file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle create content and handle clone content to write files outside the project directory via directory traversal.

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl user table.

**Name of the Vulnerable Software and Affected Versions** Isotope eCommerce versions prior to 2.9.11 **Description** The software generates order identifiers using the `uniqid()` function rather than a cryptographically secure source, which allows unauthenticated attackers to predict these identifiers. Because guest orders do not undergo ownership verification, an attacker can access sensitive order details—including billing addresses, customer information, and purchased files—by providing a guessed value to the `uid` parameter. **Recommendations** Update Isotope eCommerce to version 2.9.11 or later.

**Name of the Vulnerable Software and Affected Versions** getID3 versions prior to 1.9.27 **Description** An XML external entity injection issue exists in the `XML2array()` helper function. The function fails to properly disable entity loading when running on PHP versions before 8.0. This allows attackers to use malicious XML metadata within media files to disclose local files, perform server-side request forgery (SSRF), or cause a denial of service through entity expansion. **Recommendations** Update to version 1.9.27 or later. As a temporary mitigation, restrict the processing of media files containing XML metadata using the `XML2array()` function.

**Name of the Vulnerable Software and Affected Versions** NivoCart versions prior to 2.4.1 **Description** An arbitrary file upload flaw exists in the File Manager `multi()` endpoint. The system fails to validate file extensions for new filenames or when the `chunks` parameter is set to 2 or higher. This allows users with view-only back-office access to upload PHP files to the web-accessible `image/data/` directory, which can lead to remote code execution. **Recommendations** Update NivoCart to a version newer than 2.4.0. Restrict access to the `multi()` endpoint in the File Manager to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NivoCart versions prior to 2.4.1 **Description** A destructive configuration write issue exists in the admin password reset controller. Unauthenticated attackers can disable self-service password recovery by sending a GET request to the password reset controller with a missing or incorrect `code` parameter. This action rewrites the `config password` setting to 0, requiring an administrator to manually re-enable the feature. **Recommendations** Update NivoCart to a version newer than 2.4.0.

**Name of the Vulnerable Software and Affected Versions** getID3 versions prior to 1.9.26 **Description** An OS command injection flaw exists in shell-out handlers that fail to properly escape filenames before incorporating them into command strings. Attackers can use filenames containing shell metacharacters—special characters that the system interprets as commands or operators—to execute arbitrary commands with the privileges of the process embedding getID3. **Recommendations** Update to version 1.9.26 or later.

**Name of the Vulnerable Software and Affected Versions** NivoCart versions prior to 2.4.1 **Description** The 'forgotten.php' endpoint generates recovery codes using the `substr(md5(mt rand()), 0, 10)` method, resulting in predictable password reset tokens. An attacker with knowledge of an administrator's email address can request a password reset and predict the token to gain unauthorized administrative access. This process is further facilitated by the absence of rate limiting or token expiration. **Recommendations** Update NivoCart to a version newer than 2.4.0. As a temporary mitigation, restrict access to the 'forgotten.php' endpoint.

**Name of the Vulnerable Software and Affected Versions** django-page-cms versions prior to 2.0.14 **Description** Insufficient validation of page permissions within admin helper views allows users with staff account privileges to read arbitrary page content and stored media paths. This flaw enables attackers with low-privilege staff credentials to enumerate content identifiers and gain unauthorized access to page listings, file paths, and unpublished drafts. **Recommendations** Update to version 2.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** django-page-cms versions prior to 2.0.14 **Description** Five admin mutation views in `pages/admin/views.py` are exempt from Cross-Site Request Forgery (CSRF) protection. This allows attackers to forge requests that modify page content. Signed-in editors who visit a malicious page can be tricked into storing unescaped content that renders to all visitors, leading to stored cross-site scripting (XSS) attacks. **Recommendations** Update django-page-cms to version 2.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** HUBzero CMS versions prior to 2.2.33 **Description** The software accepts session identifiers from query strings and request variables instead of relying exclusively on cookies. This allows unauthenticated attackers to perform session fixation, where they obtain a valid session identifier and trick a victim into using it via a crafted link. Once the victim authenticates, the attacker can replay the identifier to hijack the account and gain unauthorized access. **Recommendations** Update HUBzero CMS to version 2.2.33 or later.