Mokksh Parekh

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions prior to 1.2.7 **Description** Insufficient authorization checks in an AJAX action allow unauthenticated users to modify the status of arbitrary appointments. This flaw also enables the triggering of notification emails to the affected customers via the `update appointment status` action. **Recommendations** Update TrueBooker to version 1.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** KiviCare WordPress plugin versions prior to 4.5.2 **Description** Authenticated users with a clinic staff-level role can perform SQL injection because the software fails to properly sanitize and escape user-supplied parameters before incorporating them into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update KiviCare WordPress plugin to version 4.5.2 or later.

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** Project Management, Bug and Issue Tracking Plugin for WordPress versions prior to 5.1.0 **Description** An issue exists where user-supplied input is not properly sanitized or escaped before being used in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks, which occur when malicious SQL statements are inserted into entry fields for execution. This flaw is exploitable within the standard front-end issue-tracker configuration via the search parameter. **Recommendations** Update Project Management, Bug and Issue Tracking Plugin for WordPress to version 5.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Advance Product Search versions prior to 1.4.5 **Description** An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** Update to a version newer than 1.4.4.

**Name of the Vulnerable Software and Affected Versions** degit versions prior to 2.8.6 degit versions 3.0.0 through 3.3.0 **Description** Command Injection occurs due to improper sanitization of user input used in git shell commands. The ` cloneWithGit()` and `fetchRefs()` functions directly invoke these commands using the `exec()` method. An attacker can execute arbitrary operating system commands as the process user by providing a specially crafted git repository name. This issue primarily affects template generators, project bootstrappers, and CI pipelines that process untrusted repository identifiers. **Recommendations** Update to version 2.8.6 for versions prior to 2.8.6. Update to version 3.3.1 for versions 3.0.0 through 3.3.0.