Leousum

**Name of the Vulnerable Software and Affected Versions** Piwigo versions prior to 16.3.1 **Description** A path traversal issue exists within the Image Derivative Handler component in the `i.php` file. This flaw allows remote attackers to manipulate the file path to access unauthorized directories or files on the server. **Recommendations** Update to version 16.3.1 or later. Restrict access to the `i.php` file within the Image Derivative Handler component as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** OpenCart versions 4.1.0.3 through 4.1.0.4 **Description** A cross site scripting issue exists in the Autocomplete Workflow component within the file `catalog/controller/account/edit.php`. A remote attacker can trigger this by manipulating the `firstname` argument. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `firstname` argument in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenCart versions 4.1.0.3 through 4.1.0.4 **Description** An issue exists in the Autocomplete Workflow component within the file `catalog/controller/account/address.php`. Remote manipulation of the `address 1` argument allows for cross site scripting, a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the `address 1` argument in the `catalog/controller/account/address.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Admidio versions prior to 5.0.12 **Description** Broken access control in `profile function.php` allows authenticated users with low privileges to view the future role memberships of other users. This is achieved by bypassing profile-level authorization through direct calls to the `reload future memberships` endpoint using a victim's `user UUID`. **Recommendations** Update to version 5.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Piwigo version 16.3.0 **Description** A remote cross-site scripting issue exists within the Public Authentication Page component. The flaw allows for the manipulation of the `lang` argument to execute malicious scripts. This attack is characterized by high complexity and is considered difficult to exploit. **Recommendations** Upgrade to version 16.4.0.

**Name of the Vulnerable Software and Affected Versions** kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to 95dfa8cebbb87ab46ae450643a07241274a74dce **Description** An open redirect issue exists in the Trusted Backend Interface component. The `setReferrer()` function within the `application/core/MY Controller.php` file does not properly handle the `href` argument, allowing a remote attacker to manipulate it to redirect users to an external site. **Recommendations** Apply patch 213babdbaa949e94557246414db0130e01394517. As a temporary mitigation, restrict access to the `setReferrer()` function.

**Name of the Vulnerable Software and Affected Versions** kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7 **Description** A remote attack can be initiated through the manipulation of the `shopping cart` argument in the `getCartItems()` function within the `application/libraries/ShoppingCart.php` library. This manipulation leads to deserialization, a process where data is converted back into an object, which can be exploited to execute unauthorized code. **Recommendations** Apply patch 49b20f53de2b7ec34e920b11c863f1491d911a04 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions prior to de1c9e73ccf3bd032d9a0525c4752290d959dd8b **Description** A path traversal issue exists in the Vendor Image Manager component. A remote attacker can exploit this by manipulating the `folder` argument within the `do upload others images()` function located in the `application/modules/vendor/controllers/AddProduct.php` file. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** Apply patch de1c9e73ccf3bd032d9a0525c4752290d959dd8b to resolve this issue. As a temporary mitigation, restrict access to the `do upload others images()` function.

**Name of the Vulnerable Software and Affected Versions** kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to 213babdbaa949e94557246414db0130e01394517 **Description** A remote cross site scripting issue exists in the Subscribed Emails Admin Page component. The flaw is located in the `checkForPostRequests()` function within the `application/core/MY Controller.php` file. An attacker can trigger this by manipulating the `User-Agent` variable. **Recommendations** Apply patch 23105f25dadf57b4314fc015a63a7c6e910c89df to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions prior to 49b20f53de2b7ec34e920b11c863f1491d911a04 **Description** A cross site scripting issue exists in the Hidden REST API Endpoint component. A remote attacker can exploit this by manipulating the `title` or `description` arguments at the '/index.php/api/product/set' endpoint. **Recommendations** Deploy patch d9785f995da77bdc62fb2d34bad5f7a162c9ad23.