Jidle

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.6.5 **Description** An authentication bypass exists in HTTP Canvas responses. This flaw allows lower-trust callers to forge trusted A2UI (Application-to-UI) actions, enabling attackers to perform operations that require stronger authorization by submitting crafted requests through configured input paths and bypassing intended policy checks. **Recommendations** Update OpenClaw to version 2026.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** SMTP Mailing Queue WordPress plugin versions prior to 2.0.1 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example, in a multisite setup. **Recommendations** For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Moosikay E-Commerce System version 1.0 **Description** A critical issue affects the file /Moosikay/order.php of the component POST Parameter Handler. The manipulation of the `username` argument leads to sql injection. The attack may be launched remotely. **Recommendations** For version 1.0, consider disabling the `username` argument in the /Moosikay/order.php file until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Online Boat Reservation System version 1.0 **Description** A vulnerability has been found in the file /boat/login.php of the component POST Parameter Handler. The manipulation of the argument `un` leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For SourceCodester Online Boat Reservation System version 1.0, consider disabling the `un` argument in the /boat/login.php file as a temporary workaround until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the `un` argument in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SeaCMS version 11.6 **Description** A problematic issue was found in the Picture Management component, specifically affecting some unknown functionality of the file /data/config.ftp.php. This issue leads to deserialization and can be exploited remotely. **Recommendations** For SeaCMS version 11.6, consider restricting access to the /data/config.ftp.php file until a patch is available. As a temporary workaround, avoid using the Picture Management component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.