Jackyu

**Name of the Vulnerable Software and Affected Versions** ZZZCMS version 2.2.0 **Description** A vulnerability has been found in the Personal Profile Page component of ZZZCMS, which affects some unknown processing and leads to basic cross-site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For ZZZCMS version 2.2.0, consider disabling the Personal Profile Page component until a patch is available to prevent basic cross-site scripting attacks. Restrict access to this component to minimize the risk of exploitation. Avoid using any functionality that may trigger the vulnerable processing in the Personal Profile Page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress versions up to, and including, 3.1.37.1 **Description** The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 3.1.37.1, update to a version that includes the necessary input sanitization and output escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting administrator-level permissions and ensuring that unfiltered html is enabled to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Pluck CMS version 4.7.18 **Description** A problematic issue has been identified, affecting the `install.php` file of the Installation Handler component. The manipulation of the `contents` argument with the input `<script>alert('xss')</script>` leads to cross-site scripting. This issue can be initiated remotely, with a rather high complexity of attack, making exploitation difficult. **Recommendations** For Pluck CMS version 4.7.18, consider disabling the `install.php` file or restricting access to it until a patch is available. Avoid using the `contents` argument in the affected Installation Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions up to 20230822 **Description** A critical issue affects some unknown functionality of the file /importexport.php, leading to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For versions up to 20230822, as a temporary workaround, consider restricting access to the /importexport.php file until a patch is available. Avoid using the file /importexport.php in a way that could lead to sql injection until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Free and Open Source Inventory Management System version 1.0 **Description** A critical issue has been found in the system, affecting an unknown function of the file /index.php?page=member. The manipulation of the `columns[0][data]` argument leads to SQL injection. This issue can be exploited remotely. **Recommendations** For version 1.0, consider disabling access to the /index.php?page=member endpoint until a patch is available. Restrict the use of the `columns[0][data]` argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.