Mari0X00

A stored XSS issue allows an authenticated attacker to execute arbitrary JavaScript code in the context of both authenticated and unauthenticated users through the admin panel.

Name of the Vulnerable Software and Affected Versions: MaianAffiliate version 1.0 Description: The issue allows an authenticated administrative user to save a cross-site scripting (XSS) attack to the database. This can potentially lead to malicious script execution when the saved data is accessed. Recommendations: For MaianAffiliate version 1.0, as a temporary workaround, consider restricting access to administrative functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MaianAffiliate version 1.0 Description: The issue allows for code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors. Recommendations: For MaianAffiliate version 1.0, as a temporary workaround, consider restricting access to the admin panel to minimize the risk of exploitation. Avoid using the admin panel to add new products until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows attackers to execute arbitrary SQL statements and gain remote code execution (RCE) capabilities.

Name of the Vulnerable Software and Affected Versions: Batflat version 1.3.6 Description: The issue allows an authenticated user to perform code injection, and consequently Remote Code Execution, via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data, such as `username` or `displayed name`. This issue only affects products that are no longer supported by the maintainer. Recommendations: For version 1.3.6, as a temporary workaround, consider restricting access to the Users tab in the administration panel until a resolution can be determined, however, since the product is no longer supported, this may be the only available mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.