Lihongming

**Name of the Vulnerable Software and Affected Versions** kalcaddle kodbox version 1.67 Build 02 **Description** A flaw in the msgWarning Plugin allows remote attackers to achieve improper authorization through manipulation of the '/index.php?plugin/msgWarning/action' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/index.php?plugin/msgWarning/action' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** kalcaddle kodbox version 1.67 Build 02 **Description** An issue exists in the SSO API Login component due to improper processing of the '/user/sso/apiLogin' endpoint. A remote attacker can manipulate the `callbackUrl` argument to trigger an open redirect, which occurs when an application redirects a user to an untrusted external site. **Recommendations** As a temporary workaround, restrict access to the '/user/sso/apiLogin' endpoint or avoid using the `callbackUrl` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Electronic Judging System version 1.0 **Description** A SQL injection issue exists in the `/intrams/admin/add judges.php` endpoint. This occurs when the `fname` argument is manipulated, allowing a remote attacker to execute unauthorized database queries. **Recommendations** Update itsourcecode Electronic Judging System to a version that fixes this issue. As a temporary mitigation, restrict access to the `/intrams/admin/add judges.php` endpoint or avoid using the `fname` parameter until a patch is applied.