Leekenghwa

**Name of the Vulnerable Software and Affected Versions** i-doit pro versions 25 and below **Description** The issue is related to Cross Site Scripting (XSS) and can be exploited via the `index.php` endpoint. This allows for potential malicious script injection. **Recommendations** For versions 25 and below, consider disabling access to the `index.php` endpoint until a fix is available. As a temporary workaround, restrict the use of user-inputted data in the `index.php` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** i-doit Open version v24 **Description** A reflected cross-site scripting (XSS) issue was found in i-doit Open via the `timeout` parameter on the "/login" page. This allows for potential XSS attacks. **Recommendations** For i-doit Open version v24, consider disabling access to the login page or restricting the use of the `timeout` parameter until a fix is available. Avoid using the `timeout` parameter in the login page until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** hoteldruid version 3.0.5 **Description** The issue is related to a SQL injection vulnerability. **Recommendations** For hoteldruid version 3.0.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HotelDruid version 3.0.5 **Description** A Reflected XSS issue was discovered, allowing an attacker to issue malicious code or commands on an affected webpage's parameter. This can trick users on their browsers and/or exfiltrate data. **Recommendations** For HotelDruid version 3.0.5, update to a version that includes a fix for this issue, as no specific workaround is provided in the available information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Textpattern versions 4.8.8 and below **Description** An arbitrary file upload vulnerability in the upload plugin allows attackers to execute arbitrary code by uploading a crafted PHP file. **Recommendations** For Textpattern versions 4.8.8 and below, update to a version above 4.8.8 to resolve the issue. As a temporary workaround, consider disabling the upload plugin until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation.